Package evidence

[email protected]

Remote Payload: matched "github.com/software-mansion-labs/rn-audio-libs/releases/download"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 450Mature · −50% score
First published: Aug 2024
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes1,742,923

Previous version0.13.0-nightly-a3c8bc2-20260424

Published2026-05-28T00:39:23.211Z

SHA-256db7d9c8183563e837c2d1a99f132b1e97e6c7aed7f2b46d2c049ea4e8be63b45

Why flagged

What the scanner saw

Remote Payload: matched "github.com/software-mansion-labs/rn-audio-libs/releases/download"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

20d agoLast checked

reviewRisk

3Score

0.13.0-nightly-a3deac7-20260528Version

Status history (1 event)

new → available20d ago · risk review · score 3 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/scripts/download-prebuilt-binaries.sh	matched "github.com/software-mansion-labs/rn-audio-libs/releases/download"	12

Manifest

Package metadata

Scripts28

buildbob build
create:package./scripts/create-package.sh
formatyarn format:js && yarn format:android:cpp && yarn format:android:kotlin && yarn format:ios && yarn format:common
format:android:cppfind android/src/ $ -path android/src/main/cpp/audioapi/android/libs -prune -o -type f \( -iname "*.h" -o -iname "*.cpp" -o -iname "*.hpp" $ -print \) | xargs clang-format -i
format:android:kotlinktlint -F 'android/src/main/java/**/*.kt'
format:checkyarn format:check:js && yarn format:check:android:cpp && yarn format:check:android:kotlin && yarn format:check:ios && yarn format:check:common
format:check:android:cppfind android/src/ $ -path android/src/main/cpp/audioapi/android/libs -prune -o -type f \( -iname "*.h" -o -iname "*.cpp" -o -iname "*.hpp" $ -print \) | xargs clang-format --dry-run --Werror
format:check:android:kotlinktlint 'android/src/main/java/**/*.kt'
format:check:commonfind common/cpp/ $ -path 'common/cpp/audioapi/libs' -prune -o -path 'common/cpp/audioapi/external' -prune -o -type f \( -iname "*.h" -o -iname "*.cpp" -o -iname "*.hpp" $ -print \) | xargs clang-format --dry-run --Werror
format:check:iosfind ios/audioapi/ios -type f $ -iname "*.h" -o -iname "*.m" -o -iname "*.mm" $ | xargs clang-format --dry-run --Werror
format:check:jsprettier --check src
format:commonfind common/cpp/ $ -path 'common/cpp/audioapi/libs' -prune -o -path 'common/cpp/audioapi/external' -prune -o -type f \( -iname "*.h" -o -iname "*.cpp" -o -iname "*.hpp" $ -print \) | xargs clang-format -i
format:iosfind ios/audioapi/ios -type f $ -iname "*.h" -o -iname "*.m" -o -iname "*.mm" $ | xargs clang-format -i
format:jsprettier --write --list-different src
lintyarn lint:js && yarn lint:cpp && yarn lint:ios && yarn lint:kotlin
lint:cpp./scripts/cpplint.sh
lint:iosyarn format:ios -Werror
lint:jseslint src && yarn prettier --check src
lint:kotlinktlint 'android/src/main/java/**/*.kt'
postpackrm ./README.md
prepackcp ../../README.md ./README.md
testyarn test:js && yarn test:cpp
test:cppbash common/cpp/test/RunTests.sh
test:fullyarn test && yarn test:graph
test:graphbash common/cpp/test/RunTestsGraph.sh
test:graph:dockerbash common/cpp/test/RunTestsGraphDocker.sh
test:jsjest
typechecktsc --noEmit

Dependencies1

semver^7.7.3