PkgRadar

Package evidence

[email protected]

Large Javascript Payload: 5396257 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
118
Versions published
203Mature · −50% score
First published
Sep 2024
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes3,519,396
Previous version0.3.36
Published2026-05-27T05:50:34.987Z
SHA-25658af4fa66db8a57af39559c5afe561aa6f882ebcef9c7bcadbb183e0036a268f

Why flagged

What the scanner saw

Large Javascript Payload: 5396257 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
6Score
0.3.37Version
Status history (1 event)
  1. new → available · risk review · score 6 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumLarge Javascript Payloadpackage/bin/backend.bun.js5396257 bytes10
mediumLarge Javascript Payloadpackage/app/assets/index-BzVz2XXq.js2001936 bytes10

Manifest

Package metadata

Scripts26
  • buildrm -rf ./bin && ([ $PREVIEW ] && bun run env:pre || bun run env:prod) && concurrently "bun:build:*"
  • build:bun./build.bun.ts
  • build:vite[ $PREVIEW ] && vite build --mode preview || vite build --mode production
  • db:devdotenvx run -f .env.development -- ./__scripts__/interactive-db.bun.ts
  • db:gendotenvx run -f .env.development -- drizzle-kit generate
  • db:nuke./__scripts__/destroy-db.bun.ts
  • db:setup./__scripts__/setup-db.bun.ts
  • devbun run env:dev && concurrently "bun:dev:*"
  • dev:backendbun --hot --no-clear-screen --env-file=.env.development ./src/backend.bun.ts
  • dev:dbpnpm run db:dev
  • dev:emailbun --env-file=.env.development email dev
  • dev:vitevite --port 3333
  • env:dev[ -f .env.development ] && echo '.env.development already present' || cp .env.defaults .env.development
  • env:pre[ -f .env.preview ] && echo '.env.preview already present' || cp .env.defaults .env.preview
  • env:prod[ -f .env.production ] && echo '.env.production already present' || echo 'VITE_BACKEND_ORIGIN=https://realtime.tempest.games' >> .env.production && echo 'VITE_HIDE_DEVTOOLS=true' >> .env.production
  • env:test[ -f .env.test ] && echo '.env.test already present' || cp .env.defaults .env.test
  • lintconcurrently "bun:lint:*"
  • lint:biomebiome check -- .
  • lint:eslinteslint -- .
  • lint:typestsgo --noEmit
  • previewPREVIEW=true nr build && concurrently "bun:preview:*"
  • preview:backendbun --env-file=.env.preview bin/backend.bun.js
  • preview:frontendbun --env-file=.env.preview bin/frontend.bun.js
  • testbun env:test && vitest
  • test:oncebun env:test && varmint track && vitest run; varmint clean --ci-flag=CI
  • watch:typestsgo --watch --noEmit
Dependencies29
  • @ai-sdk/openai3.0.65
  • @floating-ui/react0.27.19
  • @js-temporal/polyfill0.5.1
  • @react-spring/three10.1.0
  • @react-three/drei10.7.7
  • @react-three/fiber9.6.1
  • @t3-oss/env-core0.13.11
  • @trpc/client11.17.0
  • @trpc/server11.17.0
  • ai6.0.191
  • arktype2.2.0
  • atom.io0.47.0
  • cron4.4.0
  • drizzle-orm0.45.2
  • motion12.40.0
  • nanoid5.1.11
  • openai6.39.0
  • postgres3.4.9
  • react19.2.6
  • react-dom19.2.6
  • react-email6.3.3
  • resend6.12.4
  • safedeposit0.1.2
  • socket.io4.8.3
  • socket.io-client4.8.3
  • three0.184.0
  • three-stdlib2.36.1
  • treetrunks0.1.7
  • varmint0.5.14