Package evidence

[email protected]

Large Javascript Payload: 7872471 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 2,182Niche · −30% score
Versions published: 507Established · −30% score
First published: Aug 2025
Publisher: pingkungjaza

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherpingkungjaza

Artifact bytes7,780,709

Previous version1.1.512

Published2026-05-28T08:07:17.370Z

SHA-256dc29fc90ca7f0c65005350dcfa847a1355bcce6ea65ef452b2338019db2ad682

Why flagged

What the scanner saw

Large Javascript Payload: 7872471 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

16d agoLast checked

reviewRisk

21Score

1.1.513Version

Status history (1 event)

new → available16d ago · risk review · score 21 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/cjs/admin-register-popup_80.cjs.entry.js	7872471 bytes	10
medium	Large Javascript Payload	package/dist/esm/admin-register-popup_80.entry.js	7841762 bytes	10
medium	Large Javascript Payload	package/dist/zignal-stencil-library/p-6c14d65b.entry.js	6836057 bytes	10

Manifest

Package metadata

Scripts10

analyzeNODE_ENV=production stencil build --prod --stats
buildNODE_ENV=production stencil build --prod
formatprettier --write "src/**/*.{ts,tsx,css,json}"
format:checkprettier --check "src/**/*.{ts,tsx,css,json}"
generatestencil generate
linteslint src --ext .ts,.tsx --fix
lint:checkeslint src --ext .ts,.tsx
npm-publishyarn build && npm publish
startstencil build --dev --watch --serve
typechecktsc --noEmit

Dependencies13

@floating-ui/dom^1.7.5
axios^1.13.5
crypto-js^4.2.0
dayjs^1.11.13
dotenv^17.2.4
flex-render^0.1.9
i18next^25.8.4
idb^8.0.3
libphonenumber-js^1.12.36
lucide0.562
socket.io-client^4.8.3
sortablejs^1.15.6
zod^4.3.6