PkgRadar

Package evidence

@adcp/[email protected]

DNS / OAST exfiltration, Install Lifecycle Remote Or Exec, Install Lifecycle Suppresses Failure +4 more

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: 70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@adcp/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@adcp/[email protected]"],"fail_on":"high"}'
Artifact bytes12,678,376
Previous version8.1.0-beta.9
Published2026-05-25T02:42:57.190Z
SHA-2566cfa2290a04cfed54b059b5591c4e87b112f323e874deb33dec2dc818d1425de

Why flagged

What the scanner saw

DNS / OAST exfiltration

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
576Score
8.1.0-beta.10Version
Status history (1 event)
  1. newavailable · risk high · score 576 · status changed

Related candidates

Linked campaigns and clusters

Repeated static TTPstale

DNS / OAST exfiltration

101 members · evidence strength 71
Repeated static TTPstale

Install Lifecycle Suppresses Failure

4 members · evidence strength 90
Repeated static TTPstale

Install Lifecycle Remote Or Exec

4 members · evidence strength 90

Evidence

Static findings

99 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highDNS / OAST exfiltrationmanifest30
highDNS / OAST exfiltrationmanifest30
highDNS / OAST exfiltrationmanifest30
highDNS / OAST exfiltrationmanifest30
highInstall Lifecycle Remote Or Execmanifest30
highInstall Lifecycle Suppresses Failuremanifest20
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumObfuscation Densitymanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
Show all 99 findings (low-signal and informational)

Showing 60 of 99 findings.

SeverityKindPathDetailPoints
highDNS / OAST exfiltrationmanifest30
highDNS / OAST exfiltrationmanifest30
highDNS / OAST exfiltrationmanifest30
highDNS / OAST exfiltrationmanifest30
highInstall Lifecycle Remote Or Execmanifest30
highInstall Lifecycle Suppresses Failuremanifest20
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumObfuscation Densitymanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
mediumRemote Payloadmanifest12
lowInstall-time lifecycle scriptmanifest4
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3
lowObfuscationmanifest3

Manifest

Package metadata

Dependencies11
  • @types/ws^8.18.1
  • ajv^8.18.0
  • ajv-formats^3.0.1
  • fast-check^3.23.2
  • jose^6.2.2
  • secure-json-parse^4.1.0
  • structured-headers^2.0.2
  • tldts^7.0.29
  • undici^6.25.0
  • ws^8.20.0
  • yaml^2.7.1