BEACON

← candidates

npm @kungfu-tech/buildchain @2.14.8

score
0.6667 med
flagged 2026-07-21 11:20
signals by category
cadence 1 topology 1 enrichment 1

maintainers added:

package profile →

Signals fired

signalweightrationale
cadence
rapid_release 0.8 5 versions in last 24h: ['2.14.4', '2.14.5', '2.14.6', '2.14.7', '2.14.8']
topology
dist_tag_anomaly 0.5 dist-tags.latest=2.14.8 but max published is 2.14.9-alpha.0
enrichment
repo_too_new_for_version_history 0.7 claimed repo created 22d ago but package has 381 versions (expect >= 154d for that history)

Prior profile (what it deviated from)

{
  "had_install_script": false,
  "maintainers": [
    "dragonballs"
  ],
  "versions": 380
}

Evidence (package doc at flag time)

{
  "dependencies_count": 2,
  "dist": {
    "integrity": "sha512-bMvYE7/GPUeQ3iq6bAuqJAjGVPVjqaUIWQoYezXqZpH3Hr+dyLl69xBOA1jy/j3uPtjA20kxa/epxK2H3tC7rQ==",
    "tarball": "https://registry.npmjs.org/@kungfu-tech/buildchain/-/buildchain-2.14.8.tgz",
    "unpackedSize": 4266359
  },
  "dist-tags": {
    "alpha": "2.14.9-alpha.1",
    "bootstrap": "0.0.0-bootstrap.0",
    "latest": "2.14.8",
    "v2.12-alpha": "2.12.9-alpha.1"
  },
  "latest_version": "2.14.8",
  "maintainers": [
    {
      "email": "keren.dong@kungfu.link",
      "name": "dragonballs"
    }
  ],
  "num_versions": 381,
  "repository": {
    "type": "git",
    "url": "git+https://github.com/kungfu-systems/buildchain.git"
  },
  "scripts": {
    "binary:build": "node scripts/build-standalone-binary.mjs",
    "build": "pnpm -r --filter \"./actions/**\" build",
    "check": "node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && node scripts/check-action-bundles.mjs",
    "check:site": "node scripts/generate-site-bundle.mjs --check",
    "check:workflows": "bash scripts/check-workflows.sh",
    "generate:site": "node scripts/generate-site-bundle.mjs",
    "pack:check": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
    "package": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
    "test:unit": "node --test tests/*.test.mjs"
  },
  "signal_details": {
    "dist_tag_anomaly": "dist-tags.latest=2.14.8 but max published is 2.14.9-alpha.0",
    "rapid_release": "5 versions in last 24h: ['2.14.4', '2.14.5', '2.14.6', '2.14.7', '2.14.8']",
    "repo_too_new_for_version_history": "claimed repo created 22d ago but package has 381 versions (expect >= 154d for that history)"
  },
  "time": {
    "created": "2026-07-01T09:19:06.974Z",
    "modified": "2026-07-21T15:54:39.661Z"
  }
}