npm @bytecodealliance/jco @1.26.0
score
0.75
high
flagged
2026-07-26 23:50
Signals fired
| signal | weight | rationale |
|---|---|---|
| topology | ||
| shared_repo_different_publisher | 0.9 | repo 'git+https://github.com/bytecodealliance/jco.git' also claimed by 3 package(s) under different publishers: ['npm/@bytecodealliance/preview2-shim', 'npm/@bytecodealliance/preview3-shim', 'npm/@bytecodealliance/jco-transpile'] |
| dependency_added_unknown | 0.6 | 2 new non-watchlisted dep(s): ['componentize-qjs', 'rolldown'] |
Prior profile (what it deviated from)
{
"had_install_script": false,
"maintainers": [
"tschneidereit",
"cfallin",
"guybedford",
"vados"
],
"versions": 121
}
Evidence (package doc at flag time)
{
"dependencies_count": 11,
"dist": {
"integrity": "sha512-ddqwWuIsFi6fsqf9P8RhKUHBfMUZejSbI7y9uckNqC8u7CaCYSSPeYxqkgsXmU8I/R9ZME1pDUFMW5V10S15wQ==",
"tarball": "https://registry.npmjs.org/@bytecodealliance/jco/-/jco-1.26.0.tgz",
"unpackedSize": 279398
},
"dist-tags": {
"latest": "1.26.0",
"rc": "1.17.9-rc.0"
},
"latest_version": "1.26.0",
"maintainers": [
{
"email": "till@tillschneidereit.net",
"name": "tschneidereit"
},
{
"email": "chris@cfallin.org",
"name": "cfallin"
},
{
"email": "guybedford@gmail.com",
"name": "guybedford"
},
{
"email": "vados@vadosware.io",
"name": "vados"
}
],
"num_versions": 122,
"repository": {
"type": "git",
"url": "git+https://github.com/bytecodealliance/jco.git"
},
"scripts": {
"build": "cargo xtask build debug && npm run build:ts",
"build:release": "cargo xtask build release && npm run build:ts",
"build:test:components": "cargo xtask build-test-components",
"build:ts": "tsc -p tsconfig.json",
"build:types:preview2-shim": "pnpm run build:types:preview2-shim --include-workspace-root",
"fmt": "oxfmt",
"fmt:check": "oxfmt --check",
"lint": "oxlint",
"lint:fix": "oxlint --fix",
"test": "pnpm run build:ts && vitest run -c test/vitest.ts",
"test:extended": "pnpm run build:ts && vitest run -c test/vitest.extended.ts",
"test:lts": "pnpm run build:ts && vitest run -c test/vitest.lts.ts"
},
"signal_details": {
"dependency_added_unknown": "2 new non-watchlisted dep(s): ['componentize-qjs', 'rolldown']",
"shared_repo_different_publisher": "repo 'git+https://github.com/bytecodealliance/jco.git' also claimed by 3 package(s) under different publishers: ['npm/@bytecodealliance/preview2-shim', 'npm/@bytecodealliance/preview3-shim', 'npm/@bytecodealliance/jco-transpile']"
},
"time": {
"created": "2023-02-17T02:16:54.158Z",
"modified": "2026-07-26T08:38:52.483Z"
}
}