npm · registry.npmjs.org

@tachybase/module-file

Credential file access: matched "AWS_ACCESS_KEY"

Why PkgRadar flagged 1.6.20

Severity	Signal	Evidence
medium	Credential file access	matched "AWS_ACCESS_KEY" · package/dist/node_modules/multer-cos/index.js

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`1.6.20`	Review	7	2026-06-16
`1.6.21`	Review	7	2026-06-16
`1.6.22`	Review	7	2026-06-16
`1.6.19`	Review	7	2026-06-16

Block this in CI

PkgRadar gates @tachybase/module-file (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @tachybase/[email protected]