PkgRadar

Package evidence

[email protected]

Remote Payload: matched "raw.githubusercontent.com"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
PublisherGitHub Actions
Artifact bytes293,653
Previous version0.9.27
Published2026-05-22T19:04:51.570Z
SHA-256c408449b53d3b42b3ead74578d02779a5956f8bdda249f2a0f4e5ff13c5c7bf8

Why flagged

What the scanner saw

Remote Payload: matched "raw.githubusercontent.com"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
174Score
0.9.29Version
Status history (1 event)
  1. new → available · risk high · score 174 · status changed

Evidence

Static findings

16 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/lib/dashboards/anomaly-detection.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/coalition-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/coalition-loader.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/committees-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/cia/csv-utils.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/cia/data-loader.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/shared/data-loader.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/election-cycle.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/ministry-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/party-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/politician-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/pre-election.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/risk-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/seasonal-patterns.jsmatched "raw.githubusercontent.com"12
Show all 16 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/lib/dashboards/anomaly-detection.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/coalition-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/coalition-loader.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/committees-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/cia/csv-utils.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/cia/data-loader.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/shared/data-loader.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/election-cycle.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/ministry-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/party-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/politician-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/pre-election.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/risk-dashboard.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/lib/dashboards/seasonal-patterns.jsmatched "raw.githubusercontent.com"12
lowObfuscationpackage/dist/lib/dashboards/committees-dashboard.jsmatched "\\u26a0"3
lowObfuscationpackage/dist/lib/dashboards/politician-dashboard.jsmatched "\\uFEFF"3

Manifest

Package metadata

Scripts59
  • aggregate-analysisnpx tsx scripts/aggregate-analysis.ts --all
  • backfill-metadatatsx scripts/backfill-article-metadata.ts
  • buildvite build
  • build:csv-contracts-fixturenpx tsx scripts/build-csv-contracts-fixture.ts
  • build:libtsc -p tsconfig.lib.json && tsc -p tsconfig.npm-scripts.json
  • build:test-reportsmkdir -p docs/test-results docs/cypress docs/coverage && ([ -d builds/coverage ] && [ -n "$(ls -A builds/coverage 2>/dev/null)" ] && cp -r builds/coverage/* docs/coverage/ || echo 'No coverage directory to copy') && ([ -d builds/test-results ] && [ -n "$(ls -A builds/test-results 2>/dev/null)" ] && cp -r builds/test-results/* docs/test-results/ || echo 'No test-results directory to copy') && ([ -d builds/cypress ] && [ -n "$(ls -A builds/cypress 2>/dev/null)" ] && cp -r builds/cypress/* docs/cypress/ || echo 'No cypress directory to copy') && echo 'Test reports copied to docs/'
  • check-updatesnpx tsx scripts/check-cia-schema-updates.ts
  • check:analysis-languagetsx scripts/check-analysis-language.ts
  • check:docsnpx tsx scripts/generate-article-types-doc.ts && git diff --exit-code Article-Generation.md
  • copy-vendornpx tsx scripts/copy-vendor-mermaid.ts
  • coveragevitest run --coverage
  • cypress:opencypress open
  • cypress:runcypress run --config video=false
  • cypress:run:criticalcypress run --spec 'cypress/e2e/homepage.cy.js,cypress/e2e/accessibility.cy.js' --config video=false
  • cypress:run:fastcypress run --config video=false --quiet --browser chrome
  • devvite
  • docs:dependenciesmkdir -p docs/dependencies && (npm list --all --json > docs/dependencies/dependency-tree.json 2> docs/dependencies/dependency-tree.log || true) && (npm list --all > docs/dependencies/dependency-tree.txt 2>> docs/dependencies/dependency-tree.log || true)
  • docs:diagramsecho 'Architecture diagrams generation placeholder - implement with graphviz if needed'
  • docs:sitemaptsx scripts/generate-sitemap.ts
  • download-datanpx tsx scripts/download-parliamentary-data.ts
  • download-data:todaynpx tsx scripts/download-parliamentary-data.ts --date today
  • download-data:weeklynpx tsx scripts/download-parliamentary-data.ts --aggregate weekly
  • e2enpm run build && start-server-and-test preview http://localhost:4173 cypress:run
  • e2e:fastnpm run build && start-server-and-test preview http://localhost:4173 cypress:run:fast
  • generate-newsnpx tsx scripts/render-articles.ts --all --lang all
  • generate-news-indexesnode scripts/generate-news-indexes.ts
  • generate-political-intelligencenpx tsx scripts/generate-political-intelligence.ts
  • generate-rssnpx tsx scripts/generate-rss.ts
  • generate-sitemaptsx scripts/generate-sitemap.ts
  • generate-sitemap-htmlnpx tsx scripts/generate-sitemap-html.ts
  • …and 29 more.
Optional dependencies1
  • cypress15.15.0