BEACON

← candidates

npm just-bash @3.6.0

score
0.7416 high
flagged 2026-11-06 01:01
signals by category
topology 2

maintainers added: —

package profile →

Signals fired

signalweightrationale
topology
shared_repo_different_publisher 0.9 repo 'git+https://github.com/vercel-labs/just-bash.git' also claimed by 1 package(s) under different publishers: ['npm/@just-bash/executor']
dependency_added_unknown 0.6 2 new non-watchlisted dep(s): ['guarded-fetch', 'run']

Prior profile (what it deviated from)

{
  "had_install_script": false,
  "maintainers": [
    "cramforce"
  ],
  "versions": 97
}

Evidence (package doc at flag time)

{
  "dependencies_count": 16,
  "dist": {
    "integrity": "sha512-2COjEgcHdqKXeQSiNfPAHmpwQx4S8wATaIwog83g2t645U5tom6FED4CBBdr3M+0ioX4xZ26eODw3/nD6RQ6xw==",
    "tarball": "https://registry.npmjs.org/just-bash/-/just-bash-3.6.0.tgz",
    "unpackedSize": 21648775
  },
  "dist-tags": {
    "executor": "2.15.1-executor.0",
    "latest": "3.6.0"
  },
  "latest_version": "3.6.0",
  "maintainers": [
    {
      "email": "malte.ubl@gmail.com",
      "name": "cramforce"
    }
  ],
  "num_versions": 102,
  "repository": {
    "type": "git",
    "url": "git+https://github.com/vercel-labs/just-bash.git"
  },
  "scripts": {
    "build": "rm -rf dist && tsc && pnpm build:lib && pnpm build:lib:cjs && pnpm build:browser && pnpm build:cli && pnpm build:shell && pnpm build:worker && pnpm build:clean && cp dist/index.d.ts dist/index.d.cts && sed '1,/^-->/d' AGENTS.npm.md > dist/AGENTS.md",
    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:sprintf-js --external:turndown --external:guarded-fetch --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --define:__BROWSER__=true --alias:node:async_hooks=./src/shims/browser-unsupported.js --alias:node:dns=./src/shims/browser-unsupported.js --alias:node:module=./src/shims/browser-unsupported.js",
    "build:clean": "find dist -name '*.test.js' -delete && find dist -name '*.test.d.ts' -delete",
    "build:cli": "esbuild dist/cli/just-bash.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:run --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
    "build:lib": "esbuild dist/index.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bundle --chunk-names=chunks/[name]-[hash] --banner:js='import{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:run --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
    "build:lib:cjs": "esbuild dist/index.js --bundle --platform=node --format=cjs --minify --outfile=dist/bundle/index.cjs --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:run --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
    "build:shell": "esbuild dist/cli/shell.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin/shell --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:run --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
    "build:worker": "esbuild src/commands/python3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/python3/worker.js --external:../../../vendor/cpython-emscripten/* && cp src/commands/python3/worker.js dist/commands/python3/worker.js && mkdir -p dist/bin/chunks && cp src/commands/python3/worker.js dist/bin/chunks/worker.js && mkdir -p dist/bundle/chunks && cp src/commands/python3/worker.js dist/bundle/chunks/worker.js && esbuild src/commands/sqlite3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/sqlite3/worker.js --external:sql.js && mkdir -p dist/commands/sqlite3 && cp src/commands/sqlite3/worker.js dist/commands/sqlite3/worker.js && cp src/commands/sqlite3/worker.js dist/bin/chunks/sqlite3-worker.js && cp src/commands/sqlite3/worker.js dist/bundle/chunks/sqlite3-worker.js",
    "check:worker-sync": "node scripts/check-worker-sync.js",
    "dev:exec": "tsx src/cli/exec.ts",
    "knip": "knip",
    "lint": "pnpm lint:banned",
    "lint:banned": "node scripts/check-banned-patterns.js",
    "lint:fix": "pnpm --workspace-root lint:fix",
    "shell": "tsx src/cli/shell.ts",
    "test": "vitest",
    "test:comparison": "vitest run --config vitest.comparison.config.ts",
    "test:comparison:record": "RECORD_FIXTURES=1 vitest run --config vitest.comparison.config.ts",
    "test:coverage": "vitest run --coverage",
    "test:coverage:unit": "vitest run --config vitest.unit.config.ts --coverage",
    "test:dist": "vitest run src/cli/just-bash.bundle.test.ts src/package-contents.test.ts",
    "test:fuzz": "vitest run src/security/fuzzing/",
    "test:fuzz:long": "FUZZ_RUNS=10000 vitest run src/security/fuzzing/",
    "test:run": "vitest run --exclude src/security/fuzzing/ --exclude src/commands/python3/ --exclude src/commands/sqlite3/ --exclude src/commands/js-exec/ --exclude src/agent-examples/python-scripting.test.ts",
    "test:unit": "vitest run --config vitest.unit.config.ts",
    "test:wasm": "vitest run --config vitest.wasm.config.ts",
    "typecheck": "tsc --noEmit",
    "validate": "pnpm lint && pnpm knip && pnpm typecheck && pnpm build && pnpm check:worker-sync && pnpm test:run && pnpm test:wasm && pnpm test:dist"
  },
  "signal_details": {
    "dependency_added_unknown": "2 new non-watchlisted dep(s): ['guarded-fetch', 'run']",
    "shared_repo_different_publisher": "repo 'git+https://github.com/vercel-labs/just-bash.git' also claimed by 1 package(s) under different publishers: ['npm/@just-bash/executor']"
  },
  "time": {
    "created": "2025-12-27T18:41:08.637Z",
    "modified": "2026-10-01T12:48:03.379Z"
  }
}