Package evidence

[email protected]

Remote Dependency Spec: devDependencies.@mozilla/readability="github:mozilla/readability"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 911
Versions published: 1,250Mature · −50% score
First published: Jun 2020
Publisher: leask

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherleask

Artifact bytes909,606

Previous version2001.1.153

Published2026-05-15T19:16:03.891Z

SHA-256f7ac0c03ff67a556985793e7df9949742c42728244da9d13b6c19a442b2cc136

Why flagged

What the scanner saw

Remote Dependency Spec: devDependencies.@mozilla/readability="github:mozilla/readability"

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

18d agoLast checked

reviewRisk

7Score

2001.1.154Version

Status history (1 event)

new → available18d ago · risk review · score 7 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	devDependencies.@mozilla/readability="github:mozilla/readability"	8
medium	Remote Dependency Spec	package.json	devDependencies.url="github:Leask/node-url"	8
high	Remote Dependency Spec	package.json	devDependencies.xlsx="https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz"	8

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
devDependencies.xlsx	https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz	low	0	no remote findings

Manifest

Package metadata

Scripts9

betanpm publish --tag beta
buildnpm run updep && ( git commit -am 'update dependencies' || true ) && node build.mjs && npm run pack
debugnode --inspect --trace-warnings debug.mjs
gitsync( git commit -am "Released @ `date`" || true ) && git pull && git push
pack./node_modules/.bin/webpack-cli --config webpack.config.mjs
pubnpm run build && npm run gitsync
startnode index.mjs
testnode test.mjs
updepnpx npm-check-updates -u && npm install && wget https://raw.githubusercontent.com/Marak/colors.js/master/lib/styles.js -O ./lib/style.cjs

Dependencies3

file-type^22.0.1
mathjs^15.2.0
uuid^14.0.0