BEACON

← candidates

npm marko @5.39.3

score
0.7 high
flagged 2026-06-12 15:56
signals by category
topology 2

maintainers added:

package profile →

Signals fired

signalweightrationale
topology
dist_tag_anomaly 0.5 dist-tags.latest=5.39.3 but max published is 6.1.3
shared_repo_different_publisher 0.9 repo 'git+https://github.com/marko-js/marko.git' also claimed by 2 package(s) under different publishers: ['npm/@marko/compiler', 'npm/@marko/runtime-tags']

Prior profile (what it deviated from)

{
  "had_install_script": false,
  "maintainers": [
    "ryansolid",
    "mlrawlings",
    "agliga",
    "ryanturnquist",
    "tigt",
    "dylanpiercey",
    "lulavalva"
  ],
  "versions": 1303
}

Evidence (package doc at flag time)

{
  "dependencies_count": 15,
  "dist": {
    "integrity": "sha512-ZmiI6p9vaOGDdgmYw7bVnXhNuBKgwQTNcXv0TKFXstUh3rht7gV1iHGoFr1imeDx3Ra43OFKkDWrteUjUERHeQ==",
    "tarball": "https://registry.npmjs.org/marko/-/marko-5.39.3.tgz",
    "unpackedSize": 1489544
  },
  "dist-tags": {
    "latest": "5.39.3",
    "m2": "2.11.3",
    "m3": "3.14.4",
    "m4": "4.28.10",
    "next": "6.1.3"
  },
  "latest_version": "5.39.3",
  "maintainers": [
    {
      "email": "ryansolid@gmail.com",
      "name": "ryansolid"
    },
    {
      "email": "ml.rawlings@gmail.com",
      "name": "mlrawlings"
    },
    {
      "email": "agliga4@gmail.com",
      "name": "agliga"
    },
    {
      "email": "rturnq@gmail.com",
      "name": "ryanturnquist"
    },
    {
      "email": "npm@ti.gt",
      "name": "tigt"
    },
    {
      "email": "pierceydylan@gmail.com",
      "name": "dylanpiercey"
    },
    {
      "email": "lukelavalva@gmail.com",
      "name": "lulavalva"
    }
  ],
  "num_versions": 1304,
  "repository": {
    "directory": "packages/runtime-class",
    "type": "git",
    "url": "git+https://github.com/marko-js/marko.git"
  },
  "scripts": {
    "build": "babel ./src --out-dir ./dist --extensions .js --copy-files --config-file ../../babel.config.js --env-name=production"
  },
  "signal_details": {
    "dist_tag_anomaly": "dist-tags.latest=5.39.3 but max published is 6.1.3",
    "shared_repo_different_publisher": "repo 'git+https://github.com/marko-js/marko.git' also claimed by 2 package(s) under different publishers: ['npm/@marko/compiler', 'npm/@marko/runtime-tags']"
  },
  "time": {
    "created": "2014-09-17T15:37:36.890Z",
    "modified": "2026-06-12T20:56:04.652Z"
  }
}