npm · registry.npmjs.org
thegitbot
Credential file access: matched "GITHUB_TOKEN"
Why PkgRadar flagged 1.2.74-beta.10
| Severity | Signal | Evidence |
|---|---|---|
| high | Credential file access | matched "GITHUB_TOKEN" · package/setup/lib/prerequisites.mjs |
| high | Credential file access | matched "GITHUB_TOKEN" · package/templates/.github/workflows/run-job.yml |
| medium | Remote Payload | matched "curl " · package/lib/cluster/components/cluster-page.js |
| medium | Obfuscation Density | high encoded/escaped-token density · package/templates/skills/brave-search/package-lock.json |
| medium | Obfuscation Density | high encoded/escaped-token density · package/templates/skills/browser-tools/package-lock.json |
| medium | Remote Payload | matched "curl " · package/templates/skills/google-docs/create.sh |
| medium | Remote Payload | matched "curl " · package/templates/skills/google-drive/delete.sh |
| medium | Remote Payload | matched "curl " · package/templates/skills/google-drive/download.sh |
| medium | Remote Payload | matched "curl " · package/templates/skills/kie-ai/generate-image.sh |
| medium | Remote Payload | matched "curl " · package/templates/skills/kie-ai/generate-video.sh |
| medium | Remote Payload | matched "curl " · package/templates/skills/google-drive/list.sh |
| medium | Remote Payload | matched "curl " · package/templates/skills/google-drive/upload.sh |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
1.2.74-beta.10 | Review | 100 | 2026-05-24 |
Block this in CI
pkgradar gate --ecosystem npm [email protected]