Package evidence

@happy-creative/[email protected]

Remote Shell Cradle, Reverse Shell, New Account With Lifecycle Hook +4 more

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 1
First published: Jul 2026
Publisher: neyio

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

See the evidence — free Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@happy-creative/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@happy-creative/[email protected]"],"fail_on":"high"}'

Publisherneyio

Artifact bytes17,600,190

Previous versionnone

Published2026-07-20T15:48:08.294Z

SHA-25620a671fd722f4f3c3463789442a7376763e7fccff99660c8d9c1749988d9f248

Why flagged

What the scanner saw

Remote Shell Cradle

1 candidate cluster(s) currently reference this release.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

28h agoLast checked

highRisk

235Score

0.0.6Version

Status history (1 event)

new → available28h ago · risk high · score 235 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burstactive

Publisher burst: neyio

13 members · evidence strength 84

Publisher / release actor burstcandidate

Publisher burst: neyio

13 members · max score 262

Evidence

Static findings

16 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Remote Shell Cradle	manifest	—	45
high	Reverse Shell	manifest	—	40
high	Reverse Shell	manifest	—	40
high	New Account With Lifecycle Hook	manifest	—	25
medium	Tls Verification Disabled	manifest	—	12
medium	Tls Verification Disabled	manifest	—	12
medium	Tls Verification Disabled	manifest	—	12
medium	Tls Verification Disabled	manifest	—	12
medium	Tls Verification Disabled	manifest	—	12
medium	Credential file access	manifest	—	10
medium	Credential file access	manifest	—	10
medium	Suspicious Publish Context	manifest	—	10

Show all 16 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Remote Shell Cradle	manifest	—	45
high	Reverse Shell	manifest	—	40
high	Reverse Shell	manifest	—	40
high	New Account With Lifecycle Hook	manifest	—	25
medium	Tls Verification Disabled	manifest	—	12
medium	Tls Verification Disabled	manifest	—	12
medium	Tls Verification Disabled	manifest	—	12
medium	Tls Verification Disabled	manifest	—	12
medium	Tls Verification Disabled	manifest	—	12
medium	Credential file access	manifest	—	10
medium	Credential file access	manifest	—	10
medium	Suspicious Publish Context	manifest	—	10
low	Credential file access	manifest	—	5
low	Credential file access	manifest	—	5
low	Credential file access	manifest	—	5
low	Install-time lifecycle script	manifest	—	5

Manifest

Package metadata

Dependencies50

@anthropic-ai/sdk^0.36.1
@google/genai2.6.0
@iarna/toml^2.2.5
@modelcontextprotocol/sdk^1.25.2
@opentelemetry/api^1.9.0
@opentelemetry/exporter-logs-otlp-grpc^0.203.0
@opentelemetry/exporter-logs-otlp-http^0.203.0
@opentelemetry/exporter-metrics-otlp-grpc^0.203.0
@opentelemetry/exporter-metrics-otlp-http^0.203.0
@opentelemetry/exporter-trace-otlp-grpc^0.203.0
@opentelemetry/exporter-trace-otlp-http^0.203.0
@opentelemetry/instrumentation-http^0.203.0
@opentelemetry/instrumentation-undici^0.14.0
@opentelemetry/sdk-node^0.203.0
@xterm/headless5.5.0
ajv^8.17.1
ajv-formats^3.0.0
async-mutex^0.5.0
chardet^2.1.0
chokidar^4.0.3
diff^7.0.0
dotenv^17.1.0
fast-levenshtein^2.0.6
fast-uri^3.0.6
fdir^6.4.6
fzf^0.5.2
glob^10.5.0
google-auth-library^10.5.0
https-proxy-agent^7.0.6
iconv-lite^0.6.3
…and 20 more.

Optional dependencies6

@lydell/node-pty1.2.0-beta.10
@lydell/node-pty-darwin-arm641.2.0-beta.10
@lydell/node-pty-darwin-x641.2.0-beta.10
@lydell/node-pty-linux-x641.2.0-beta.10
@lydell/node-pty-win32-arm641.2.0-beta.10
@lydell/node-pty-win32-x641.2.0-beta.10