// npm package

@ncremental/web-vitals

Show a small widget on top of the page with some of the most crucial web vitals.

npmjs.com tarball

weekly

monthly

versions

maintainers

first publish

2022-01-28

publisher

carl-eric.lavoie.ncremental

tarball

10,061 B

AUTO-PUBLISHED·1 version indexed·latest published 2026-05-27

// publisher campaignby carl-eric.lavoie.ncremental

2 caught packages from this account

This is not an isolated catch. The same publisher has shipped 1 other package that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @21.0.15· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@21.0.15·2026-05-27·AUTO-PUBLISHED·publisher: carl-eric.lavoie.ncremental

heuristic 75/100

static flags 0

llm benign (0.85) via ollama

new-publisher:1drecent-owner-changemature-packagepublisher-multi-name-burst:2dormant-takeover:prev=clampr_ncremental@17.0.15

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· no static-pattern hits

--- package.json (entry) ---
{
  "name": "@ncremental/web-vitals",
  "version": "21.0.15",
  "peerDependencies": {
    "@angular/common": "^21.2.14",
    "@angular/core": "^21.2.14",
    "web-vitals": "^2.1.4"
  },
  "dependencies": {
    "tslib": "^2.0.0"
  },
  "publishConfig": {
    "@ncremental:registry": "https://registry.npmjs.org/",
    "access": "public"
  },
  "module": "fesm2022/ncremental-web-vitals.mjs",
  "typings": "types/ncremental-web-vitals.d.ts",
  "exports": {
    "./package.json": {
      "default": "./package.json"
    },
    ".": {
      "types": "./types/ncremental-web-vitals.d.ts",
      "default": "./fesm2022/ncremental-web-vitals.mjs"
    }
  },
  "sideEffects": false,
  "type": "module"
}