BEACON

← candidates

npm @actual-app/web @26.6.0

score
0.7333 high
flagged 2026-06-02 05:38
signals by category
topology 3

maintainers added:

package profile →

Signals fired

signalweightrationale
topology
dist_tag_anomaly 0.5 dist-tags.latest=26.6.0 but max published is 26.7.0-nightly.20260602
mass_publish_burst 0.8 publisher 'GitHub Actions' pushed 9 packages in the last 15min on npm
shared_repo_different_publisher 0.9 repo 'git+https://github.com/actualbudget/actual.git' also claimed by 4 package(s) under different publishers: ['npm/@actual-app/core', 'npm/@actual-app/sync-server', 'npm/@actual-app/api'] ...

Prior profile (what it deviated from)

{
  "had_install_script": false,
  "maintainers": [
    "actual-app-user",
    "matissjanis",
    "dolphish",
    "joeljeremy",
    "matt-fidd",
    "actualbudget"
  ],
  "versions": 405
}

Evidence (package doc at flag time)

{
  "dependencies_count": 0,
  "dist": {
    "integrity": "sha512-Yq7eLi993ePPveOY0qNJq8gDbEx0QEASx2j/hBNHpeaJeXlZphmPrkjcWofgPLPsBHCXH3OjXlahx3JeWz0J9Q==",
    "tarball": "https://registry.npmjs.org/@actual-app/web/-/web-26.6.0.tgz",
    "unpackedSize": 59446823
  },
  "dist-tags": {
    "latest": "26.6.0",
    "nightly": "26.7.0-nightly.20260602"
  },
  "latest_version": "26.6.0",
  "maintainers": [
    {
      "email": "help@actualbudget.com",
      "name": "actual-app-user"
    },
    {
      "email": "npmjs.org@mja.lv",
      "name": "matissjanis"
    },
    {
      "email": "julian.dominguezschatz@gmail.com",
      "name": "dolphish"
    },
    {
      "email": "joeljeremy.marquez@gmail.com",
      "name": "joeljeremy"
    },
    {
      "email": "npm@m.fiddaman.uk",
      "name": "matt-fidd"
    },
    {
      "email": "dev@actualbudget.org",
      "name": "actualbudget"
    }
  ],
  "num_versions": 419,
  "repository": {
    "directory": "packages/desktop-client",
    "type": "git",
    "url": "git+https://github.com/actualbudget/actual.git"
  },
  "scripts": {
    "build": "vite build",
    "build:browser": "vite build --mode=browser",
    "e2e": "npx playwright test --browser=chromium",
    "generate:i18n": "i18next",
    "playwright": "playwright",
    "start": "cross-env PORT=3001 vite",
    "start:browser": "cross-env ./bin/watch-browser",
    "test": "vitest --run",
    "typecheck": "tsgo -b && tsc-strict",
    "validate:theme-catalog": "node --experimental-strip-types bin/validate-theme-catalog.mts",
    "vrt": "cross-env VRT=true npx playwright test --browser=chromium",
    "watch": "cross-env BROWSER=none yarn start"
  },
  "signal_details": {
    "dist_tag_anomaly": "dist-tags.latest=26.6.0 but max published is 26.7.0-nightly.20260602",
    "mass_publish_burst": "publisher 'GitHub Actions' pushed 9 packages in the last 15min on npm",
    "shared_repo_different_publisher": "repo 'git+https://github.com/actualbudget/actual.git' also claimed by 4 package(s) under different publishers: ['npm/@actual-app/core', 'npm/@actual-app/sync-server', 'npm/@actual-app/api'] ..."
  },
  "time": {
    "created": "2022-04-28T22:03:19.835Z",
    "modified": "2026-06-02T00:39:51.743Z"
  }
}