BEACON

← candidates

npm @kungfu-tech/buildchain @2.14.11

score
0.6667 med
flagged 2026-07-21 14:10
signals by category
cadence 1 topology 1 enrichment 1

maintainers added:

package profile →

Signals fired

signalweightrationale
cadence
rapid_release 0.8 8 versions in last 24h: ['2.14.7', '2.14.8', '2.14.9', '2.14.10', '2.14.11']
topology
dist_tag_anomaly 0.5 dist-tags.latest=2.14.11 but max published is 2.14.12-alpha.0
enrichment
repo_too_new_for_version_history 0.7 claimed repo created 22d ago but package has 390 versions (expect >= 155d for that history)

Prior profile (what it deviated from)

{
  "had_install_script": false,
  "maintainers": [
    "dragonballs"
  ],
  "versions": 390
}

Evidence (package doc at flag time)

{
  "dependencies_count": 2,
  "dist": {
    "integrity": "sha512-ALvu+v8U7ikYqIt8vuaTMb6YF/vBq51xMIwjhmW5AOd6RrHwIR+vkDBhYz3E4+8dd6gyjMxM3gMJ0FXpACarXg==",
    "tarball": "https://registry.npmjs.org/@kungfu-tech/buildchain/-/buildchain-2.14.11.tgz",
    "unpackedSize": 4272112
  },
  "dist-tags": {
    "alpha": "2.14.12-alpha.0",
    "bootstrap": "0.0.0-bootstrap.0",
    "latest": "2.14.11",
    "v2.12-alpha": "2.12.9-alpha.1"
  },
  "latest_version": "2.14.11",
  "maintainers": [
    {
      "email": "keren.dong@kungfu.link",
      "name": "dragonballs"
    }
  ],
  "num_versions": 390,
  "repository": {
    "type": "git",
    "url": "git+https://github.com/kungfu-systems/buildchain.git"
  },
  "scripts": {
    "binary:build": "node scripts/build-standalone-binary.mjs",
    "build": "pnpm -r --filter \"./actions/**\" build",
    "check": "node scripts/check-inventory.mjs && pnpm run check:site && pnpm run check:workflows && pnpm run test:unit && node scripts/check-action-bundles.mjs",
    "check:site": "node scripts/generate-site-bundle.mjs --check",
    "check:workflows": "bash scripts/check-workflows.sh",
    "generate:site": "node scripts/generate-site-bundle.mjs",
    "pack:check": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
    "package": "npm pack --dry-run --json --registry=https://registry.npmjs.org/",
    "test:unit": "node --test tests/*.test.mjs"
  },
  "signal_details": {
    "dist_tag_anomaly": "dist-tags.latest=2.14.11 but max published is 2.14.12-alpha.0",
    "rapid_release": "8 versions in last 24h: ['2.14.7', '2.14.8', '2.14.9', '2.14.10', '2.14.11']",
    "repo_too_new_for_version_history": "claimed repo created 22d ago but package has 390 versions (expect >= 155d for that history)"
  },
  "time": {
    "created": "2026-07-01T09:19:06.974Z",
    "modified": "2026-07-21T18:59:50.839Z"
  }
}