package risk