PkgRadar

Package evidence

[email protected]

no findings

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
246
Versions published
25
First published
May 2026
Publisher
davidbatista

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherdavidbatista
Artifact bytes272,272
Previous version0.6.4
Published2026-05-29T18:44:39.196Z
SHA-25689bea390ca536199c52ed9dd796913bde31275715bdaffbe9782acb991c7a52b

Why flagged

What the scanner saw

No high-signal static finding in the saved report.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
0.6.5Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

No findings stored for this release.

Manifest

Package metadata

Scripts29
  • buildtsc -p tsconfig.json
  • devtsx src/index.ts
  • prepacknpm run build && node -e "require('node:fs').accessSync('dist/index.js')"
  • prepublishOnlynpm test
  • smokenode scripts/smoke-tools.mjs
  • smoke:httpnode scripts/smoke-http.mjs
  • startnode dist/index.js
  • testnpm run typecheck && npm run build && npm run test:normalization && npm run test:providers && npm run test:intake-store && npm run test:hydration-goals && npm run test:goal-progress && npm run test:meal-estimator && npm run test:display-names && npm run test:image-tools && npm run test:summary && npm run test:privacy && npm run test:http-helper && npm run test:local-date && npm run test:carbon && npm run test:security && npm run test:ux-tools && npm run test:coach-wearable && npm run smoke && npm run smoke:http && npm run test:cli-ux && npm run test:agent-readiness && npm run test:hermes-agent && npm run prepack && npm run test:metadata
  • test:agent-readinessnode scripts/agent-readiness-test.mjs
  • test:carbonnode scripts/test-carbon.mjs
  • test:cli-uxnode scripts/cli-ux-test.mjs
  • test:coach-wearablenode scripts/test-coach-wearable.mjs
  • test:display-namesnode scripts/test-display-names.mjs
  • test:goal-progressnode scripts/test-goal-progress.mjs
  • test:hermes-agentnode scripts/hermes-agent-manifest-test.mjs
  • test:http-helpernode scripts/test-http-helper.mjs
  • test:hydration-goalsnode scripts/test-hydration-goals.mjs
  • test:image-toolsnode scripts/test-image-tools.mjs
  • test:intake-storenode scripts/test-intake-store.mjs
  • test:local-datenode scripts/test-local-date.mjs
  • test:meal-estimatornode scripts/test-meal-estimator.mjs
  • test:metadatanode scripts/metadata-check.mjs
  • test:normalizationnode scripts/test-normalization.mjs
  • test:privacynode scripts/privacy-redaction-test.mjs
  • test:providersnode scripts/test-providers.mjs
  • test:securitynode scripts/test-security-and-locks.mjs
  • test:summarynode scripts/test-summary.mjs
  • test:ux-toolsnode scripts/test-ux-tools.mjs
  • typechecktsc --noEmit -p tsconfig.json
Dependencies7
  • @modelcontextprotocol/ext-apps^1.7.2
  • @modelcontextprotocol/sdk^1.29.0
  • @zxing/library^0.21.3
  • cors^2.8.6
  • express^5.2.1
  • sharp^0.34.5
  • zod^4.4.3