BEACON

← candidates

npm xgplayer-hls.js @3.0.24

score
0.7 high
flagged 2026-06-22 04:29
signals by category
topology 3

maintainers added:

package profile →

Signals fired

signalweightrationale
topology
typosquat 1.0 combosquat of 'hls.js'
dist_tag_anomaly 0.5 dist-tags.latest=3.0.24 but max published is 3.0.25-rc.1
shared_repo_different_publisher 0.9 repo 'git+https://github.com/bytedance/xgplayer.git' also claimed by 10 package(s) under different publishers: ['npm/xgplayer-music', 'npm/xgplayer-flv.js', 'npm/xgplayer-mp4-loader'] ...

Prior profile (what it deviated from)

{
  "had_install_script": false,
  "maintainers": [
    "gemstone",
    "cucygh",
    "hongqiongxing",
    "leonardo-fu",
    "zhangxin92",
    "bethelight",
    "lixiangfeiorg"
  ],
  "versions": 254
}

Evidence (package doc at flag time)

{
  "dependencies_count": 3,
  "dist": {
    "integrity": "sha512-XLPeYevtCI01/HxqjmWhTrdAD9mopMfd/J4QadCeUc5V+64mcN97RqyhE3m2XAhLqKIdmG34Qkvngz8AAwGEQw==",
    "tarball": "https://registry.npmjs.org/xgplayer-hls.js/-/xgplayer-hls.js-3.0.24.tgz",
    "unpackedSize": 1404984
  },
  "dist-tags": {
    "alpha": "3.0.25-alpha.3",
    "beta": "3.0.23-beta.19",
    "canary": "1.1.9-canary.3",
    "latest": "3.0.24",
    "oversea": "2.2.5-canary.0",
    "rc": "3.0.25-rc.15",
    "v2_alpha": "2.6.5-alpha.0"
  },
  "latest_version": "3.0.24",
  "maintainers": [
    {
      "email": "gems.xu@gmail.com",
      "name": "gemstone"
    },
    {
      "email": "cuc_ygh@163.com",
      "name": "cucygh"
    },
    {
      "email": "hongqiongxing@126.com",
      "name": "hongqiongxing"
    },
    {
      "email": "yuhao.fu1995@gmail.com",
      "name": "leonardo-fu"
    },
    {
      "email": "zhangxin.frontend@bytedance.com",
      "name": "zhangxin92"
    },
    {
      "email": "lzbethelight@gmail.com",
      "name": "bethelight"
    },
    {
      "email": "840965802@qq.com",
      "name": "lixiangfeiorg"
    }
  ],
  "num_versions": 256,
  "repository": {
    "type": "git",
    "url": "git+https://github.com/bytedance/xgplayer.git"
  },
  "scripts": null,
  "signal_details": {
    "dist_tag_anomaly": "dist-tags.latest=3.0.24 but max published is 3.0.25-rc.1",
    "shared_repo_different_publisher": "repo 'git+https://github.com/bytedance/xgplayer.git' also claimed by 10 package(s) under different publishers: ['npm/xgplayer-music', 'npm/xgplayer-flv.js', 'npm/xgplayer-mp4-loader'] ...",
    "typosquat": "combosquat of 'hls.js'"
  },
  "time": {
    "created": "2018-06-24T03:58:21.126Z",
    "modified": "2026-06-22T09:28:57.557Z"
  }
}