npm @imtbl/cryptofiat @2.24.0
score
0.7
high
flagged
2026-07-28 22:18
Signals fired
| signal | weight | rationale |
|---|---|---|
| topology | ||
| dist_tag_anomaly | 0.5 | dist-tags.latest=2.24.0 but max published is 2.24.1-0 |
| shared_repo_different_publisher | 0.9 | repo 'immutable/ts-immutable-sdk.git' also claimed by 9 package(s) under different publishers: ['npm/@imtbl/toolkit', 'npm/@imtbl/metrics', 'npm/@imtbl/generated-clients'] ... |
| repository_url_changed | 0.7 | 'git+https://github.com/immutable/ts-immutable-sdk.git' -> 'immutable/ts-immutable-sdk.git' |
Prior profile (what it deviated from)
{
"had_install_script": false,
"maintainers": [
"tcurtin88",
"alex-immutable",
"immutable-npm"
],
"versions": 431
}
Evidence (package doc at flag time)
{
"dependencies_count": 2,
"dist": {
"integrity": "sha512-aE3c2RB21AQAHRQStv32Y1PZxevCM2YuIn0D+3b3iy/itkinwnrFqgTK0IepD0aT9TPBoo5eHBINGjYHvo6PtA==",
"tarball": "https://registry.npmjs.org/@imtbl/cryptofiat/-/cryptofiat-2.24.0.tgz",
"unpackedSize": 20542
},
"dist-tags": {
"alpha": "2.24.1-0",
"latest": "2.24.0"
},
"latest_version": "2.24.0",
"maintainers": [
{
"email": "timj.curtin@gmail.com",
"name": "tcurtin88"
},
{
"email": "alex@immutable.com",
"name": "alex-immutable"
},
{
"email": "security@immutable.com",
"name": "immutable-npm"
}
],
"num_versions": 433,
"repository": {
"type": "git",
"url": "immutable/ts-immutable-sdk.git"
},
"scripts": {
"build": "pnpm transpile && pnpm typegen",
"pack:root": "pnpm pack --pack-destination $(dirname $(pnpm root -w))",
"test": "jest",
"test:watch": "jest --watch",
"transpile": "tsdown",
"typecheck": "tsc --customConditions default --noEmit --jsx preserve",
"typegen": "tsc --customConditions default --emitDeclarationOnly --outDir dist/types"
},
"signal_details": {
"dist_tag_anomaly": "dist-tags.latest=2.24.0 but max published is 2.24.1-0",
"repository_url_changed": "'git+https://github.com/immutable/ts-immutable-sdk.git' -> 'immutable/ts-immutable-sdk.git'",
"shared_repo_different_publisher": "repo 'immutable/ts-immutable-sdk.git' also claimed by 9 package(s) under different publishers: ['npm/@imtbl/toolkit', 'npm/@imtbl/metrics', 'npm/@imtbl/generated-clients'] ..."
},
"time": {
"created": "2024-12-10T03:30:29.381Z",
"modified": "2026-07-29T03:18:32.242Z"
}
}