Package evidence

[email protected]

Large Javascript Payload: 3437658 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,118Niche · −30% score
Versions published: 113
First published: Jan 2026
Publisher: filipexyz

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherfilipexyz

Artifact bytes3,540,382

Previous version3.260607.1

Published2026-06-07T00:36:47.114Z

SHA-256f3b37414152b4b127c53cb45d3d31dae6d7fd38d64b3313449615c6bd2829034

Why flagged

What the scanner saw

Large Javascript Payload: 3437658 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low

6d agoLast checked

lowRisk

0Score

3.260607.2Version

Status history (1 event)

new → available6d ago · risk low · score 0 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Large Javascript Payload	package/dist/bundle/index.js	3437658 bytes	0
low	Obfuscation Density	package/dist/tui/index.js	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts32

buildbun run build:cli && bun run build:tui && bun run gen:plugins
build:clibun build src/cli/index.ts --outdir dist/bundle --target bun --minify --keep-names --sourcemap=linked --external ink --external react --external '@anthropic-ai/*' --external openai --external '@google/*' --external nats --external '@elevenlabs/*'
build:tuibun build src/tui/index.tsx --outdir dist/tui --target bun --keep-names --sourcemap=linked --external '@opentui/core' --external '@opentui/react' --external react --external nats
check:docsbun run lint:docs && bun run docs:check-links
clibun src/cli/index.ts
devbun --watch src/index.ts
docs:check-linksbun scripts/docs-link-audit.mjs
docs:devcd docs && bunx mintlify dev
docs:listbun scripts/docs-list.js
docs:openapibun src/cli/index.ts sdk openapi emit --out docs/openapi.json
gen:commandsbun scripts/gen-commands.ts
gen:pluginsbun scripts/gen-plugins.ts
lintbunx biome check src/
lint:docsbunx markdownlint-cli2 "**/*.{md,mdx}" "#node_modules" "#docs/node_modules"
lint:docs:fixbunx markdownlint-cli2 --fix
lint:fixbunx biome check --write src/
prebuildbun run gen:commands
predocs:devbun run docs:openapi
prepackbun run build
preparegit config core.hooksPath .githooks 2>/dev/null || true
rc505:debugswift src/tui/bridges/rc505-bridge.swift --debug-sources
reference:contextbun src/reference/context-cli.ts
sdk:checkbun src/cli/index.ts sdk client check
sdk:generatebun src/cli/index.ts sdk client generate
startbun src/index.ts
testbun test src/bash/ src/hooks/ src/router/ src/heartbeat/ src/permissions/ src/triggers/ src/omni/ src/plugins/ src/adapters/ src/approval/ src/tui/hooks/runtime-feed.test.ts src/tui/hooks/runtime-display.test.ts src/gateway-typing.test.ts && bun test src/tasks/ src/projects/ src/workflow-substrate/ src/whatsapp-overlay/ && bun run test:cli-commands && bun test src/bot.runtime-guards.test.ts && bun test src/remote-spawn-nats.test.ts && bun test src/runtime/index.test.ts src/runtime/model-catalog.test.ts && bun test src/runtime/context-registry.test.ts && bun test src/cli/context.test.ts src/cli/logging.test.ts src/cli/tui-launcher.test.ts && bun test src/utils/logger.test.ts && bun test src/transcripts.test.ts && bun run test:sdk
test:cli-commandsfor f in src/cli/commands/*.test.ts; do bun test "$f" || exit 1; done
test:liveRAVI_LIVE_TESTS=1 bun test src/runtime/*.live.test.ts && RAVI_LIVE_TESTS=1 bun test src/bot.live.test.ts
test:sdkbun test src/sdk/client-codegen/ ./tests/integration/sdk-roundtrip.test.ts ./packages/ravi-os-sdk/src/__tests__/types.test-d.ts ./packages/ravi-os-sdk/src/__tests__/streaming.test.ts && bun run sdk:check
tuibun src/tui/index.tsx
…and 2 more.

Dependencies19

@anthropic-ai/claude-agent-sdk^0.2.113
@elevenlabs/elevenlabs-js^2.37.0
@google/genai^1.41.0
@hapi/boom^10.0.1
@opentui/core^0.1.81
@opentui/react^0.1.81
@strudel/web1.3.0
agora-agent-server-sdk^1.3.2
commander^14.0.2
croner^10.0.1
ink^6.6.0
ink-text-input^6.0.0
nats^2.29.3
openai^6.17.0
pino^9.6.0
qrcode-terminal^0.12.0
react^19.2.4
reflect-metadata^0.2.2
zod^4.3.6