PkgRadar

Package evidence

[email protected]

Large Javascript Payload: 9450363 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
645
Versions published
19Established · −30% score
First published
Aug 2025
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes20,296,474
Previous version1.2.14
Published2026-05-21T06:05:38.621Z
SHA-2569fc7780064881f951127377d37ba8db000d5e751a809ccb60375b38f08cf243e

Why flagged

What the scanner saw

Large Javascript Payload: 9450363 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
13Score
1.2.15Version
Status history (1 event)
  1. new → available · risk review · score 13 · status changed

Evidence

Static findings

6 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/dist/quikdown_edit_standalone.esm.js9450363 bytes10
mediumLarge Javascript Payloadpackage/dist/quikdown_edit_standalone.esm.min.js3988206 bytes10
mediumLarge Javascript Payloadpackage/dist/quikdown_edit_standalone.umd.js9696445 bytes10
mediumLarge Javascript Payloadpackage/dist/quikdown_edit_standalone.umd.min.js3988440 bytes10
Show all 6 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/dist/quikdown_edit_standalone.esm.js9450363 bytes10
mediumLarge Javascript Payloadpackage/dist/quikdown_edit_standalone.esm.min.js3988206 bytes10
mediumLarge Javascript Payloadpackage/dist/quikdown_edit_standalone.umd.js9696445 bytes10
mediumLarge Javascript Payloadpackage/dist/quikdown_edit_standalone.umd.min.js3988440 bytes10
lowObfuscationpackage/dist/quikdown_edit.esm.min.jsmatched "\\x3c"3
lowObfuscationpackage/dist/quikdown_edit.umd.min.jsmatched "\\x3c"3

Manifest

Package metadata

Scripts42
  • buildnpm run lint && npm run updateVersion && rollup -c && npm run css && npm run sizes && npm run updateBadges && npm run buildSite
  • build:airgapnode tools/buildAirgapZip.cjs
  • build:allnpm run build && npm run build:standalone
  • build:coveragerollup -c rollup.config.coverage.js
  • build:cssnode tools/generateThemeCSS.js
  • build:standalonerollup -c rollup.config.standalone.js
  • buildSitenode ./tools/buildSite.js
  • cleannode tools/clean.cjs
  • coverage:fullnpm run build:coverage && npm run test:e2e:coverage && npm test && npm run coverage:merge
  • coverage:mergenode tools/mergeCoverage.cjs
  • cssnpm run build:css && npm run minify:css
  • devnpx bwcli serve . -p 6811
  • docs:apinpx jsdoc src/quikdown.js -d docs/api
  • featurebash ./tools/feature.sh
  • linteslint src/
  • minify:cssnode tools/minifyThemeCSS.js
  • preparehusky
  • releasebash ./tools/release.sh
  • release:legacynode ./tools/createRelease.js
  • servenpx bwcli serve . -p 6811
  • sizesnode tools/printSizes.cjs
  • tag./tools/createTag.sh
  • testNODE_NO_WARNINGS=1 jest --coverage && node tools/updateBadges.js
  • test:allNODE_NO_WARNINGS=1 jest tests/quikdown.test.js tests/quikdown_bd.test.js tests/quikdown_edit_esm.test.js --coverage
  • test:astNODE_NO_WARNINGS=1 jest --testPathPattern='quikdown_ast|quikdown_json|quikdown_yaml|quikdown_ast_html' --coverage
  • test:bdNODE_NO_WARNINGS=1 jest tests/quikdown_bd.test.js --coverage
  • test:coverageNODE_NO_WARNINGS=1 jest tests/quikdown.test.js tests/quikdown_bd.test.js tests/quikdown_edit_esm.test.js --coverage --coverageReporters=text-summary
  • test:e2enpx playwright test --config=playwright.config.cjs --grep-invert @coverage
  • test:e2e:coveragenpx playwright test --grep @coverage --config=playwright.config.cjs --project=chromium
  • test:e2e:fullnpx playwright test --config=playwright.config.cjs --grep-invert @coverage
  • …and 12 more.