npm @malloydata/malloyyo @0.2.20
score
0.5842
med
flagged
2026-07-28 18:26
Signals fired
| signal | weight | rationale |
|---|---|---|
| topology | ||
| shared_repo_different_publisher | 0.9 | repo 'git+https://github.com/malloydata/malloyyo.git' also claimed by 1 package(s) under different publishers: ['npm/malloyyo'] |
| dependency_added_unknown | 0.6 | 2 new non-watchlisted dep(s): ['@duckdb/duckdb-wasm', '@malloydata/db-duckdb'] |
| enrichment | ||
| repo_too_new_for_version_history | 0.7 | claimed repo created 69d ago but package has 21 versions (expect >= 79d for that history) |
Prior profile (what it deviated from)
{
"had_install_script": false,
"maintainers": [
"malloy-lang-user",
"gmaden",
"scullin",
"mtoy"
],
"versions": 20
}
Evidence (package doc at flag time)
{
"dependencies_count": 14,
"dist": {
"integrity": "sha512-0GRRyp/c/qNN1YW2H6tH/sXdwiqfB/e2OXbB3b1s6X4bVWbX78gOGV0n9zimXYCjj41j7DCyOBDwYw4FK5/2rw==",
"tarball": "https://registry.npmjs.org/@malloydata/malloyyo/-/malloyyo-0.2.20.tgz",
"unpackedSize": 355965
},
"dist-tags": {
"latest": "0.2.20"
},
"latest_version": "0.2.20",
"maintainers": [
{
"email": "bporterfield@google.com",
"name": "malloy-lang-user"
},
{
"email": "maden@google.com",
"name": "gmaden"
},
{
"email": "scullin@scullinsteel.com",
"name": "scullin"
},
{
"email": "mtoy@malloydata.org",
"name": "mtoy"
}
],
"num_versions": 21,
"repository": {
"directory": "packages/cli",
"type": "git",
"url": "git+https://github.com/malloydata/malloyyo.git"
},
"scripts": {
"build": "npm run build:engine && esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --external:esbuild --external:@malloydata/* --external:@modelcontextprotocol/* --outfile=dist/index.js && node scripts/copy-frame-src.mjs",
"build:engine": "cd ../mcp-engine && npm run build",
"dev": "tsx src/index.ts",
"prepublishOnly": "npm run build",
"pretest": "npm run build",
"release": "tsx scripts/release.ts",
"test": "tsx --test test/*.test.ts",
"typecheck": "tsc --noEmit"
},
"signal_details": {
"dependency_added_unknown": "2 new non-watchlisted dep(s): ['@duckdb/duckdb-wasm', '@malloydata/db-duckdb']",
"repo_too_new_for_version_history": "claimed repo created 69d ago but package has 21 versions (expect >= 79d for that history)",
"shared_repo_different_publisher": "repo 'git+https://github.com/malloydata/malloyyo.git' also claimed by 1 package(s) under different publishers: ['npm/malloyyo']"
},
"time": {
"created": "2026-06-22T20:41:34.515Z",
"modified": "2026-07-28T23:26:17.559Z"
}
}