PkgRadar

Package evidence

[email protected]

no findings

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
230
Versions published
45
First published
Feb 2026
Publisher
pekeler

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherpekeler
Artifact bytes2,285,568
Previous version0.39.3-pocketbun.4
Published2026-06-12T20:14:46.949Z
SHA-2566ae7fa832a9467403cdd55ff2c1be0ed951ba066ecafeb88b8cac437c66dc319

Why flagged

What the scanner saw

No high-signal static finding in the saved report.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
0.39.3-pocketbun.5Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

No findings stored for this release.

Manifest

Package metadata

Scripts37
  • agent-scriptbun run scripts/agent_script.ts
  • bench:upstreambun run scripts/bench_run_upstream.ts
  • bench:upstream:factor-summarybun scripts/bench_upstream_factor_summary.js
  • bench:upstream:pocketbunbun run scripts/bench_run_upstream_pocketbun.ts
  • buildbun build index.ts src/cli.ts --outdir dist --target bun --format esm --packages external && bun run build:types
  • build:analyzebun build index.ts src/cli.ts --outdir=.tmp/build-analysis --target=bun --format=esm --packages external --metafile=.tmp/build-analysis/meta.json --metafile-md=.tmp/build-analysis/meta.md
  • build:typesbun x tsc -p tsconfig.types.json && bun run scripts/build_declarations.ts
  • check:versionsbun run scripts/check_versions.ts && bun run scripts/docs/sync_docs_version.ts --check
  • docs:checkbun run scripts/docs/sync_docs_version.ts --check && bun run scripts/docs/check_generated_docs.ts
  • docs:patchbun run scripts/docs/apply_pocketbun_patches.ts
  • docs:rebuildbun run scripts/docs/rebuild_from_upstream.ts && bun run docs:patch && bun run docs:version
  • docs:rebuild:fullbun run docs:sync-upstream && bun run docs:rebuild && bun run docs:check
  • docs:sync-upstreambash scripts/docs/sync_upstream_site_docs.sh
  • docs:versionbun run scripts/docs/sync_docs_version.ts
  • e2ebun run scripts/e2e_run.ts
  • e2e:installplaywright install --with-deps
  • formatoxfmt --check src tests scripts
  • format:fixoxfmt --write src tests scripts
  • lintoxlint --type-aware src tests scripts
  • prepackbun run build
  • profile:cpubash scripts/profile_cpu_md.sh
  • profile:heapbash scripts/profile_heap_md.sh
  • profile:heap:scenariobash scripts/profile_heap_scenario.sh
  • profile:inspector:listbun run scripts/profile_inspector_records_list.ts
  • releasebash scripts/release.sh publish pocketbun
  • release:checkbun run format:fix && bun run check:versions && bun test --concurrent && bun run typecheck && bun run typecheck:package && bun run lint
  • release:createbash scripts/release.sh publish create-pocketbun
  • release:create:drybash scripts/release.sh dry create-pocketbun
  • release:drybash scripts/release.sh dry pocketbun
  • startbun run index.ts
  • …and 7 more.