PkgRadar

Package evidence

[email protected]

Suspicious Publish Context: {"package_age_days":7,"publisher":"brightybrainiac","burst_same_day":1,"burst_week":1,"lure":null,"version_anomaly":false,"new_account":true}

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
898
Versions published
12
First published
Jun 2026
Publisher
brightybrainiac

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherbrightybrainiac
Artifact bytes249,771
Previous version0.1.11
Published2026-06-12T16:29:33.488Z
SHA-2564e17968d22f84acae2773a815c7bec99f8aabafa0f47a2b04f73b431679e8a28

Why flagged

What the scanner saw

Suspicious Publish Context: {"package_age_days":7,"publisher":"brightybrainiac","burst_same_day":1,"burst_week":1,"lure":null,"version_anomaly":false,"new_account":true}

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
10Score
0.1.12Version
Status history (1 event)
  1. new → available · risk review · score 10 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumSuspicious Publish Contextmanifest{"package_age_days":7,"publisher":"brightybrainiac","burst_same_day":1,"burst_week":1,"lure":null,"version_anomaly":false,"new_account":true}10

Manifest

Package metadata

Scripts39
  • audit:hosted-demo-currentnessnode scripts/audit-hosted-demo-currentness.mjs
  • audit:live-hosted-model-statusnode scripts/audit-live-hosted-model-status.mjs
  • audit:npm-release-preflightnode scripts/audit-npm-release-preflight.mjs
  • audit:package-installabilitynode scripts/audit-package-installability.mjs
  • audit:package-readinessnode scripts/audit-package-readiness.mjs
  • audit:public-demo-exportnode scripts/audit-public-demo-export.mjs
  • audit:public-package-currentnessnode scripts/audit-public-package-currentness.mjs
  • audit:real-splunk-proofnode scripts/audit-real-splunk-proof.mjs
  • audit:release-alignmentnode scripts/audit-release-alignment.mjs
  • audit:reviewersnode scripts/audit-reviewer-inbox.mjs
  • audit:secret-env-ignorebash scripts/audit-secret-env-ignore.sh
  • audit:splunkbase-listing-dossiernode scripts/audit-splunkbase-listing-dossier.mjs
  • audit:splunkbase-readinessnode scripts/audit-splunkbase-readiness.mjs
  • audit:submission-copynode scripts/audit-submission-copy.mjs
  • buildtsc --outDir dist
  • build:standalone-releasenode scripts/build-standalone-release.mjs --smoke
  • checknpm run verify:scaffold && npm run verify:runtime-contracts && npm run build && npm run ui:build && npm run audit:public-demo-export && npm run audit:package-readiness && npm run audit:package-installability && npm test && npm run audit:secret-env-ignore && npm run audit:reviewers && npm run audit:submission-copy && git diff --check
  • judge-proofnpm run build && node dist/src/cli.js judge-proof --out artifacts/judge-proof --json
  • judge-proof:llmnpm run build && node dist/src/cli.js judge-proof --out artifacts/judge-proof --include-llm-proof true --json
  • live-mock-proofnpm run build && node dist/src/cli.js live-proof --out submission-evidence/live-mock --live-mock --json
  • llm-proofnpm run build && node dist/src/cli.js llm-proof --out artifacts/llm-proof --require-pass true --json
  • mcpnpm run build && node dist/src/mcp/server.js
  • mcp-proofnpm run build && node dist/src/cli.js mcp-proof --out artifacts/mcp-proof --live-mock --json
  • platform-proofnpm run build && node scripts/run-platform-devex-proof.mjs
  • pr-gate:samplenpm run build && node -e "require('node:fs').rmSync('submission-evidence/ci-pr-gate',{recursive:true,force:true})" && node dist/src/cli.js live-proof --out submission-evidence/ci-pr-gate --live-mock --json && node dist/src/cli.js proof-audit --out submission-evidence/ci-pr-gate --json && node scripts/render-pr-gate-comment.mjs --proof-dir submission-evidence/ci-pr-gate --out submission-evidence/ci-pr-gate/pr-comment.md --json-out submission-evidence/ci-pr-gate/ci-pr-gate.json
  • public-demo:buildnpm run build && npm run ui:build && node scripts/export-public-demo.js
  • public-demo:deploy:netlifynpm run public-demo:build && npx netlify deploy --dir=artifacts/public-demo
  • real-splunk-stress-proofnode scripts/run-real-splunk-stress-proof.mjs
  • score-calibrationnpm run build && node scripts/run-readiness-score-calibration.mjs --out submission-evidence/readiness-score-calibration --json
  • splunk-app:packagenpm run public-demo:build && node scripts/build-splunk-app-package.mjs
  • …and 9 more.
Dependencies1
  • zod^3.25.76