BEACON

← candidates

npm run402-mcp @3.5.1

score
0.8 high
flagged 2026-06-22 08:58
signals by category
topology 2

maintainers added:

package profile →

Signals fired

signalweightrationale
topology
typosquat 1.0 combosquat of 'run402'
shared_repo_different_publisher 0.9 repo 'git+https://github.com/kychee-com/run402.git' also claimed by 4 package(s) under different publishers: ['npm/@run402/astro', 'npm/@run402/functions', 'npm/@run402/sdk'] ...

Prior profile (what it deviated from)

{
  "had_install_script": false,
  "maintainers": [
    "kychee"
  ],
  "versions": 217
}

Evidence (package doc at flag time)

{
  "dependencies_count": 4,
  "dist": {
    "integrity": "sha512-pBZ7gEgrDACqNgmSx8lOjUEq3lD+cw+6szHReLvSzanTzfT3aZWcFSBryuZxeWIPA7KHaXHFKR9L2NENXFEciQ==",
    "tarball": "https://registry.npmjs.org/run402-mcp/-/run402-mcp-3.5.1.tgz",
    "unpackedSize": 2833856
  },
  "dist-tags": {
    "latest": "3.5.1"
  },
  "latest_version": "3.5.1",
  "maintainers": [
    {
      "email": "tal@kychee.com",
      "name": "kychee"
    }
  ],
  "num_versions": 218,
  "repository": {
    "type": "git",
    "url": "git+https://github.com/kychee-com/run402.git"
  },
  "scripts": {
    "build": "rm -rf dist cli/core-dist cli/sdk/dist cli/sdk/core-dist && npm run build:core && npm run build:sdk && tsc && mkdir -p cli/core-dist cli/sdk/dist cli/sdk/core-dist && cp core/dist/*.js cli/core-dist/ && cp -R sdk/dist/. cli/sdk/dist/ && cp sdk/core-dist/*.js cli/sdk/core-dist/",
    "build:core": "rm -rf core/dist && tsc -p core/tsconfig.json",
    "build:sdk": "rm -rf sdk/dist sdk/core-dist && mkdir -p sdk/core-dist && cp core/dist/*.js sdk/core-dist/ && cp core/dist/*.d.ts sdk/core-dist/ && tsc -p sdk/tsconfig.json",
    "start": "node dist/index.js",
    "test": "npm run build && node --experimental-test-module-mocks --test --import tsx SKILL.test.ts sync.test.ts 'core/src/**/*.test.ts' 'sdk/src/**/*.test.ts' 'src/**/*.test.ts' && node --test cli-output-contract.test.mjs cli-e2e.test.mjs cli-help.test.mjs cli-provision-active.test.mjs cli-argv.test.mjs cli-env.test.mjs cli-wallets.test.mjs cli-org.test.mjs cli-ci.test.mjs cli-deploy-ci.test.mjs cli-operator-loopback.test.mjs && npm run test:docs",
    "test:docs": "npm run check:docs --workspace=@run402/sdk -- --skip-build",
    "test:e2e": "node --test cli-output-contract.test.mjs cli-e2e.test.mjs cli-help.test.mjs cli-provision-active.test.mjs cli-argv.test.mjs cli-env.test.mjs cli-wallets.test.mjs cli-org.test.mjs cli-ci.test.mjs cli-deploy-ci.test.mjs cli-operator-loopback.test.mjs",
    "test:help": "node --test cli-help.test.mjs",
    "test:integration": "node --test --import tsx core/src/siwx-integration.integ.ts",
    "test:integration:full": "node --test --import tsx cli-integration.test.ts",
    "test:integration:fullstack": "npm run build && node --test --import tsx fullstack-integration.test.ts",
    "test:integration:mcp": "node --test --import tsx mcp-integration.test.ts",
    "test:skill": "node --test --import tsx SKILL.test.ts",
    "test:sync": "node --test --import tsx sync.test.ts"
  },
  "signal_details": {
    "shared_repo_different_publisher": "repo 'git+https://github.com/kychee-com/run402.git' also claimed by 4 package(s) under different publishers: ['npm/@run402/astro', 'npm/@run402/functions', 'npm/@run402/sdk'] ...",
    "typosquat": "combosquat of 'run402'"
  },
  "time": {
    "created": "2026-03-05T12:03:13.954Z",
    "modified": "2026-06-22T13:57:53.210Z"
  }
}