Methodology
Why a good scanner doesn’t block the AWS SDK.
A supply-chain scanner that flags @aws-sdk, esbuild, or uvicornas dangerous is not being cautious — it is being useless. Every false block on a package a team actually depends on spends trust it doesn’t get back, and teaches developers to click through the next alert without reading it. Precision on the packages people really install is not a nice-to-have. It is the product.
The dual-use problem
Some of the strongest malware signals are also ordinary behavior for legitimate infrastructure. The same static fact — “this package reads a credential file” — is a smoking gun in a two-day-old package with nine downloads and a yawn in the official AWS SDK. The signal is real either way; what changes is the context.
| Signal | Why a legit package trips it | Why malware trips it |
|---|---|---|
credential_paths | The AWS SDK, botocore, and awscli read ~/.aws/credentials; google-auth-library reads the GCP equivalent — because that is literally their job. | A credential stealer greps the same paths to exfiltrate them. |
native_binary_main_entry | esbuild and @swc/core ship a precompiled native artifact (a Go executable, a native Node addon) that a static reader sees only as an opaque blob — that is the whole point of a compiled tool. | A dropper hides its payload in a compiled binary so a static reader can't see the source. |
tls_verification_disabled | requests, httpx, aiohttp, and redis-py all let you turn off TLS verification (for self-signed dev endpoints), or carry it in test code. | Malware disables verification so its C2 traffic survives a MITM inspection proxy. |
install_lifecycle_script | sharp, better-sqlite3, and node-pty run a postinstall to fetch or build a native addon for the host platform. | One of the most common npm attacks is a postinstall that runs attacker code before a single line is imported. |
Reputation is a discount, not a bypass
PkgRadar discounts a package’s risk score by how established it is — real weekly-download volume pulled from the registry, plus release tenure. A package with millions of weekly installs and years of releases has been observed long enough that a purely dual-use signal (a credential path, a precompiled binary, a TLS option) should not, on its own, block a build. Those packages land at Review — surfaced for anyone who wants to look — rather than High, which fails the CI gate.
Two things make this safe rather than a loophole. First, the discount keys on real download counts from the registry, which an attacker cannot fake — a freshly-published malicious package has no download history to hide behind. Second, and more importantly, the discount only ever softens the dual-use signals. It never touches a behavioral gun.
A real compromise trips something a CLI never ships
This is the load-bearing distinction. A legitimate precompiled CLI ships a binary and an install script and nothing else alarming. A compromised package — even one with millions of downloads — ships something extra: a javascript-obfuscator string-array payload, a reverse shell, a base64-decoded command, a fetch-and-execute, a webhook it POSTs harvested data to. Those are behavioral guns, and PkgRadar keeps them at High regardless of how popular the package is.
So when a hugely-downloaded package’s new release suddenly adds a preinstall hook and ships obfuscator-packed code, the download count buys it nothing. The obfuscator finding is not dual-use — a caching library has no honest reason to pack its own source — so the verdict stays High and the gate stays shut. Reputation softens the boring signals; it is deliberately blind to the dangerous ones. That is the shape of the maintainer-compromise attacks that hit packages like event-stream and ua-parser-js — a trusted, heavily-depended-on release path turned hostile — and it is the case the discount must never soften.
We publish both numbers
On our held-out evaluation corpus PkgRadar holds 0 false positives — 100% precision, and we publish the exact corpus size and composition on the accuracy page. We publish recall too, and we treat the static-only figure as a floor rather than a ceiling: we expect the live catch rate to run higher, because the live scanner adds reputation, OSV cross-referencing, and remote-payload following on top of the static pass measured there.
The honest trade we make: we would rather send a popular package to Review than block a clean one. Loosening rules to chase a bigger recall number is easy. Keeping the gate quiet enough that developers still read it is the hard part, and the one that decides whether a scanner is worth having in the pipeline at all.