Package evidence

@juspay/[email protected]

Credential file access, Install Lifecycle Suppresses Failure, Remote Payload +3 more

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

See the evidence — free Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@juspay/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@juspay/[email protected]"],"fail_on":"high"}'

PublisherGitHub Actions

Artifact bytes4,921,445

Previous version9.65.2

Published2026-05-24T20:50:46.841Z

SHA-256e0403242abdd8222afb75b4fbc5de4eaabf4fbca9b49093f2273175f584a493a

Why flagged

What the scanner saw

Credential file access

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

76d agoLast checked

highRisk

2620Score

9.66.0Version

Status history (1 event)

new → available76d ago · risk high · score 2620 · status changed

Related candidates

Linked campaigns and clusters

Repeated static TTPstale

Install Lifecycle Suppresses Failure

4 members · evidence strength 90

Evidence

Static findings

163 static · 0 from release diff · showing high-signal first.

Showing 30 of 86 findings.

Severity	Kind	Path	Detail	Points
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30

Show all 163 findings (low-signal and informational)

Showing 60 of 163 findings.

Severity	Kind	Path	Detail	Points
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30
high	Credential file access	manifest	—	30

Manifest

Package metadata

Dependencies51

@ai-sdk/anthropic^3.0.50
@ai-sdk/azure^3.0.38
@ai-sdk/mistral^3.0.21
@ai-sdk/openai^3.0.37
@ai-sdk/openai-compatible^2.0.41
@ai-sdk/provider^3.0.8
@anthropic-ai/vertex-sdk^0.16.0
@aws-sdk/client-bedrock^3.1000.0
@aws-sdk/client-bedrock-runtime^3.1000.0
@aws-sdk/client-sagemaker-runtime^3.1000.0
@aws-sdk/credential-provider-node^3.886.0
@aws-sdk/types^3.862.0
@google-cloud/text-to-speech^6.4.0
@google-cloud/vertexai^1.10.0
@google/genai^1.43.0
@huggingface/inference^4.13.14
@modelcontextprotocol/sdk^1.27.1
@openrouter/ai-sdk-provider^2.2.3
@opentelemetry/api-logs^0.214.0
@opentelemetry/context-async-hooks^2.6.1
@opentelemetry/core^2.6.0
@opentelemetry/exporter-logs-otlp-http^0.214.0
@opentelemetry/exporter-metrics-otlp-http^0.214.0
@opentelemetry/exporter-trace-otlp-http^0.214.0
@opentelemetry/resources^2.6.0
@opentelemetry/sdk-logs^0.214.0
@opentelemetry/sdk-metrics^2.6.1
@opentelemetry/sdk-trace-base^2.6.0
@opentelemetry/semantic-conventions^1.40.0
adm-zip^0.5.16
…and 21 more.

Optional dependencies25

@aws-sdk/client-sagemaker^3.1000.0
@fastify/cors^11.2.0
@fastify/rate-limit^10.3.0
@hono/node-server^1.19.9
@koa/cors^5.0.0
@koa/router^15.3.1
@langfuse/otel^5.0.1
@picovoice/cobra-node^3.0.2
bullmq^5.52.2
cors^2.8.5
exceljs^4.4.0
express^5.1.0
express-rate-limit^8.2.1
fastify^5.7.2
ffmpeg-static^5.3.0
fluent-ffmpeg^2.1.3
koa^3.1.1
koa-bodyparser^4.4.1
mammoth^1.11.0
mediabunny^1.40.1
music-metadata^11.11.2
pdf-parse^2.4.5
pdf-to-img^5.0.0
pptxgenjs^4.0.1
sharp^0.34.5