npm · registry.npmjs.org
@underpostnet/underpost
Credential file access: matched ".ssh/"
Why PkgRadar flagged 3.2.22
| Severity | Signal | Evidence |
|---|---|---|
| medium | Credential file access | matched ".ssh/" · package/src/cli/baremetal.js |
| medium | Credential file access | matched "id_rsa" · package/src/cli/cloud-init.js |
| medium | Credential file access | matched ".ssh/" · package/src/cli/system.js |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
3.2.22 | Review | 20 | 2026-06-07 |
3.2.21 | Review | 20 | 2026-06-06 |
3.2.14 | Review | 20 | 2026-06-02 |
3.2.12 | Review | 20 | 2026-05-31 |
3.2.11 | Review | 20 | 2026-05-31 |
3.2.10 | Review | 20 | 2026-05-30 |
3.2.9 | Review | 20 | 2026-05-30 |
Block this in CI
pkgradar gate --ecosystem npm @underpostnet/[email protected]