Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 12,317Mainstream · −50% score
- Versions published
- 255Mature · −50% score
- First published
- Apr 2017
- Publisher
- emeeks
Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Obfuscation Density: high encoded/escaped-token density
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 3 · status changed
Evidence
Static findings
1 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/ai/dist/mcp-server.js | high encoded/escaped-token density | 12 |
Manifest
Package metadata
Scripts64
benchvitest benchbench:baselinenode scripts/save-bench-baseline.mjsbench:comparenode scripts/compare-bench-baseline.mjsbench:pr-vs-mainnode scripts/bench-pr-vs-main.mjsbench:uivitest bench --uibuildparcel build --target websitebuild:analyzenode --max-old-space-size=8192 scripts/build.mjs --analyzebuild:mcpesbuild ai/mcp-server.ts --bundle --platform=node --target=node18 --format=cjs --outfile=ai/dist/mcp-server.js --external:react --external:react-dom --external:semiotic --external:semiotic/ai --external:semiotic/geo --banner:js='#!/usr/bin/env node'build:prodnode --max-old-space-size=8192 scripts/build.mjs --productioncheck:ai-contractsnode scripts/generate-ai-behavior-contracts.mjs --checkcheck:ai-examples-coveragenode scripts/check-ai-examples-coverage.mjscheck:api-surfacenode scripts/check-api-surface.mjscheck:blog-entriesnode scripts/check-blog-entry-sync.mjscheck:bundle-sizesnode scripts/sync-bundle-sizes.mjs --checkcheck:capabilitiesnode scripts/check-capabilities.mjscheck:chart-specsnpx tsx scripts/check-chart-specs.tscheck:claude-md-coveragenode scripts/check-claude-md-coverage.jscheck:context7node scripts/check-context7.mjscheck:docs-routesnode scripts/check-docs-routes.mjscheck:jsdoc-coveragenode scripts/check-jsdoc-coverage.mjscheck:mcp-registrynode scripts/check-mcp-registry.mjscheck:packnode scripts/smoke-pack.mjscheck:ssrnode scripts/check-ssr-alignment.jscheck:surfacenode scripts/check-surface-parity.jscheck:test-qualitynode scripts/check-test-quality-gate.mjscleanrm -rf .parcel-cache docs/build dist && echo 'All caches and build artifacts cleared'create-release-branchsh ./scripts/create-release-branch.shdistnode --max-old-space-size=8192 scripts/build.mjsdist:prodnode --max-old-space-size=8192 scripts/build.mjs --productiondocs:ai-contractsnode scripts/generate-ai-behavior-contracts.mjs- …and 34 more.
Dependencies15
d3-array^3.2.4d3-brush^3.0.0d3-chord^3.0.1d3-force^3.0.0d3-geo^3.1.1d3-hierarchy^3.1.2d3-interpolate^3.0.1d3-quadtree^3.0.1d3-scale^4.0.2d3-selection^3.0.0d3-shape^3.2.0d3-zoom^3.0.0regression^2.0.1topojson-client^3.1.0world-atlas^2.0.2
Optional dependencies2
gifenc^1.0.3sharp>=0.33.0