PkgRadar

Package evidence

[email protected]

Remote Dependency Spec, Install-time lifecycle script, Large Javascript Payload +2 more

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
1,004Established · −30% score
First published
Feb 2026
Publisher
nicholai.exe

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

See the evidence — freeAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publishernicholai.exe
Artifact bytes1,039,992
Previous version0.214.7
Published2026-08-22T05:56:12.322Z
SHA-256df79a75d83a6f75b00a8e7e0da56bc64608588322f6a34d367bab212e9b2473b

Why flagged

What the scanner saw

New Lifecycle Script Vs Previous

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
245Score
0.214.8Version
Status history (1 event)
  1. new → available · risk high · score 245 · status changed

Evidence

Static findings

7 static · 6 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highNew Lifecycle Script Vs Previousmanifest—40
highRemote Dependency Specmanifest—35
highRemote Dependency Specmanifest—35
highRemote Dependency Specmanifest—35
highRemote Dependency Specmanifest—35
highRemote Dependency Specmanifest—35
highDependency Changed To Remote Vs Previousmanifest—35
highDependency Changed To Remote Vs Previousmanifest—35
highDependency Changed To Remote Vs Previousmanifest—35
highDependency Changed To Remote Vs Previousmanifest—35
highDependency Changed To Remote Vs Previousmanifest—35
Show all 13 findings (low-signal and informational)
SeverityKindPathDetailPoints
highNew Lifecycle Script Vs Previousmanifest—40
highRemote Dependency Specmanifest—35
highRemote Dependency Specmanifest—35
highRemote Dependency Specmanifest—35
highRemote Dependency Specmanifest—35
highRemote Dependency Specmanifest—35
highDependency Changed To Remote Vs Previousmanifest—35
highDependency Changed To Remote Vs Previousmanifest—35
highDependency Changed To Remote Vs Previousmanifest—35
highDependency Changed To Remote Vs Previousmanifest—35
highDependency Changed To Remote Vs Previousmanifest—35
lowInstall-time lifecycle scriptmanifest—5
lowLarge Javascript Payloadmanifest—0

Manifest

Package metadata

Optional dependencies5
  • signetai-darwin-arm64https://github.com/Signet-AI/signetai/releases/download/v0.214.8/signetai-darwin-arm64-0.214.8.tgz
  • signetai-darwin-x64https://github.com/Signet-AI/signetai/releases/download/v0.214.8/signetai-darwin-x64-0.214.8.tgz
  • signetai-linux-arm64https://github.com/Signet-AI/signetai/releases/download/v0.214.8/signetai-linux-arm64-0.214.8.tgz
  • signetai-linux-x64https://github.com/Signet-AI/signetai/releases/download/v0.214.8/signetai-linux-x64-0.214.8.tgz
  • signetai-win32-x64https://github.com/Signet-AI/signetai/releases/download/v0.214.8/signetai-win32-x64-0.214.8.tgz