BEACON

← candidates

npm @pdpp/mcp-server @0.19.3

score
0.7391 high
flagged 2026-07-21 12:48
signals by category
identity 1 topology 2

maintainers added: lfdt-npm

package profile →

Signals fired

signalweightrationale
identity
maintainer_churn 1.0 added: ['lfdt-npm']
topology
shared_repo_different_publisher 0.9 repo 'git+https://github.com/vana-com/pdpp.git' also claimed by 2 package(s) under different publishers: ['npm/@pdpp/cli', 'npm/@pdpp/local-collector']
dependency_added_unknown 0.6 1 new non-watchlisted dep(s): ['@pdpp/read-core']

Prior profile (what it deviated from)

{
  "had_install_script": false,
  "maintainers": [
    "tnunamak",
    "tim_vana"
  ],
  "versions": 41
}

Evidence (package doc at flag time)

{
  "dependencies_count": 4,
  "dist": {
    "integrity": "sha512-iB6O0c1kldiXMHpM4XDKMCFuVNJCw/EV7m/SAPybF8H6vMlU3xuRW7oXOVtOaSbqeLqroTBIKyUZKdiE4iwthw==",
    "tarball": "https://registry.npmjs.org/@pdpp/mcp-server/-/mcp-server-0.19.3.tgz",
    "unpackedSize": 160507
  },
  "dist-tags": {
    "beta": "0.1.0-beta.8",
    "latest": "0.19.3"
  },
  "latest_version": "0.19.3",
  "maintainers": [
    {
      "email": "tnunamak@gmail.com",
      "name": "tnunamak"
    },
    {
      "email": "tim@opendatalabs.xyz",
      "name": "tim_vana"
    },
    {
      "email": "npm@lfdecentralizedtrust.org",
      "name": "lfdt-npm"
    }
  ],
  "num_versions": 77,
  "repository": {
    "directory": "packages/mcp-server",
    "type": "git",
    "url": "git+https://github.com/vana-com/pdpp.git"
  },
  "scripts": {
    "pack:dry-run": "pnpm pack --dry-run",
    "test": "node --test test/*.test.js",
    "test:read-surface": "node --test test/hostile-client-read-evidence.test.js test/server.integration.test.js",
    "verify": "pnpm test && node bin/pdpp-mcp-server.js --help"
  },
  "signal_details": {
    "dependency_added_unknown": "1 new non-watchlisted dep(s): ['@pdpp/read-core']",
    "maintainer_churn": "added: ['lfdt-npm']",
    "shared_repo_different_publisher": "repo 'git+https://github.com/vana-com/pdpp.git' also claimed by 2 package(s) under different publishers: ['npm/@pdpp/cli', 'npm/@pdpp/local-collector']"
  },
  "time": {
    "created": "2026-06-10T19:18:47.091Z",
    "modified": "2026-07-21T17:48:39.063Z"
  }
}