PkgRadar

Package evidence

[email protected]

Large Javascript Payload: 2317685 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
642Mature · −50% score
First published
Apr 2020
Publisher
lavrton

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherlavrton
Artifact bytes1,162,824
Previous version3.0.3
Published2026-06-20T07:07:59.613Z
SHA-25622e3f625bc1a05e96d1232957d7dbf8a800ef2cde6098518740beb4f5cac2e55

Why flagged

What the scanner saw

Large Javascript Payload: 2317685 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
3.1.0Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowLarge Javascript Payloadpackage/polotno.bundle.js2317685 bytes0

Manifest

Package metadata

Scripts17
  • add_versionsed -i.bak 's/SDK_VERSION/'$npm_package_version'/' ./lib/utils/validate-key.js && rm -f ./lib/utils/validate-key.js.bak
  • buildpnpm run typecheck && pnpm run clean && pnpm run prefix-build && pnpm run tsc && pnpm run add_version && node rename-imports.js && pnpm run minify && pnpm run build:css && pnpm run check:css && pnpm run check:agreement && pnpm run build:bundle && node blueprint-scope.js && cp ./src/fonts.css ./lib/fonts.css && mkdir -p ./lib/themes && cp ./src/themes/blueprint.css ./lib/themes/blueprint.css && node build/copy-package-json.cjs && cp ./README.md ./lib && cp ./LICENSE.md ./lib && pnpm run remove-test-from-lib
  • build:bundlevite build && find ./lib -name '*.js.map' -type f -delete
  • build:csstailwindcss -i ./.pn-build/ui.css -o ./lib/ui.css --minify && node build/rename-keyframes.cjs ./lib/ui.css
  • check:agreementnode build/check-agreement.cjs ./lib/ui.css ./lib/toolbar ./lib/side-panel ./lib/pages-timeline ./lib/primitives ./lib/canvas
  • check:cssnode build/check-css-hygiene.cjs ./lib/ui.css
  • check:paritynode build/structural-parity.cjs
  • cleanrm -rf ./lib && rm -rf ./.pn-build
  • minifynode minify.cjs
  • prefix-buildnode build/prefix-build.cjs
  • remove-test-from-libfind ./lib -type d -name "__tests__" -exec rm -rf {} + && find ./lib \( -name "*.test.js" -o -name "*.test.d.ts" \) -type f -delete
  • sizepnpm run build && size-limit
  • startvite
  • testvitest run
  • test:paritypnpm run check:parity && pnpm run check:agreement && pnpm run check:css
  • tsctsc --project tsconfig.lib.json --removeComments --sourceMap false
  • typechecktsc --noEmit -p tsconfig.json
Dependencies27
  • @base-ui/react^1.5.0
  • @polotno/schema0.1.0
  • class-variance-authority^0.7.1
  • clsx^2.1.1
  • gifuct-js^2.1.2
  • gradient-parser^1.2.0
  • konva^10.3.0
  • lodash-es^4.18.1
  • lucide-react^1.18.0
  • mediabunny^1.47.0
  • mensch^0.3.4
  • mobx6.16.1
  • mobx-react-lite^4.1.1
  • mobx-state-tree7.2.0
  • nanoid^5.1.11
  • quill^2.0.3
  • react-konva18.2.16
  • react-konva-utils^2.0.0
  • react-sortablejs6.1.4
  • react-window^1.8.11
  • render-tag^0.1.15
  • sortablejs^1.15.7
  • svg-round-corners^0.4.3
  • swr^2.4.1
  • tailwind-merge^3.6.0
  • tinycolor2^1.6.0
  • use-image^1.1.4