Package evidence

[email protected]

Remote Dependency Spec: dependencies.uWebSockets.js="github:uNetworking/uWebSockets.js#v20.68.0"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 3
First published: Jun 2026
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes17,312

Previous version1.0.1

Published2026-06-09T14:37:32.448Z

SHA-256afdf1eb8971209d5ea0d44d84403e80df62d8bae44b2ea521d1e2798cb6d7242

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.uWebSockets.js="github:uNetworking/uWebSockets.js#v20.68.0"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

5h agoLast checked

reviewRisk

3Score

1.0.2Version

Status history (1 event)

new → available5h ago · risk review · score 3 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	dependencies.uWebSockets.js="github:uNetworking/uWebSockets.js#v20.68.0"	12

Manifest

Package metadata

Scripts18

buildpnpm run build:clean && pnpm run build:node && pnpm run build:docs && pnpm run build:format
build:cleanrm -rf dist
build:docsrm -rf temp docs/api && api-extractor run -l && api-documenter markdown -i ./temp -o ./docs/api
build:formatpretty-quick
build:nodetsc -p tsconfig.build.json
demoPI_WS_HOST=127.0.0.1 PI_WS_PORT=8787 PI_WS_PI_ARGS="--no-session" tsx src/bin/pi-ws.ts
demo:builtPI_WS_HOST=127.0.0.1 PI_WS_PORT=8787 PI_WS_PI_ARGS="--no-session" node dist/bin/pi-ws.js
devtsx watch src/bin/pi-ws.ts
example:chatpnpm build && node examples/run-chat.mjs
lintpnpm run lint:types && pnpm run lint:codestyle && pnpm run lint:packages
lint:codestyleeslint
lint:packagespnpm audit --prod --audit-level=high
lint:typestsc -p tsconfig.json
releasesemantic-release
startnode dist/bin/pi-ws.js
testpnpm run lint && pnpm run test:unit
test:unitnode --no-warnings --import tsx --experimental-test-coverage --test-reporter=lcov --test-reporter-destination=lcov.info --test test/** --test-coverage-exclude=test/**
test:unit:localnode --no-warnings --import tsx --test test/** --test-coverage-exclude=test/**

Dependencies3

@earendil-works/pi-coding-agent0.79.0
dotenv^17.4.2
uWebSockets.jsgithub:uNetworking/uWebSockets.js#v20.68.0