PkgRadar

Package evidence

@anuragsingk/[email protected]

Credential file access: matched "id_rsa"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
1
First published
Jun 2026
Publisher
anuragsingkk

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@anuragsingk/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@anuragsingk/[email protected]"],"fail_on":"review"}'
Publisheranuragsingkk
Artifact bytes943,987
Previous versionnone
Published2026-06-09T09:16:50.178Z
SHA-25666c12c800de678bf06185f0eb9c8ac2f9325fc87c49c91548055a7abbe1fd9e0

Why flagged

What the scanner saw

Credential file access: matched "id_rsa"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
10Score
3.3.12Version
Status history (1 event)
  1. new → available · risk review · score 10 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/dist/security/AISecurityScanner.jsmatched "id_rsa"5
lowCredential file accesspackage/src/security/AISecurityScanner.tsmatched "id_rsa"5

Manifest

Package metadata

Scripts71
  • buildtsc && tsc-alias
  • build:watchtsc --watch
  • check:cinpm run typecheck && npm run lint && npm run test:coverage
  • check:ignorenode scripts/sync-ignore-files.js
  • devnpm run build && DEBUG=true node dist/index.js
  • docker:builddocker build -t docdyhr/mcp-wordpress:latest .
  • docker:publish./scripts/manual-docker-publish.sh
  • docs:generatenpm run build && node scripts/generate-docs.js
  • docs:servenpm run docs:generate && node scripts/serve-docs.js
  • docs:validatenpm run docs:generate && node scripts/validate-docs.js
  • docs:watchnpm run docs:generate && echo 'Watching for changes...' && npm run docs:serve
  • doctor:vscodenpm run test:vscode && echo ' 🩺 VS Code health check complete'
  • dxt:cleanrm -rf dxt-build mcp-wordpress.dxt minimal-dxt-build mcp-wordpress-minimal.dxt mcp-wordpress-official.dxt
  • dxt:packagenpm run dxt:clean && npm run dxt:build
  • dxt:package:officialnpm run build && node scripts/build-dxt-clean.cjs
  • evalnpm run build && npx mcp-eval evaluations/config/wordpress-tools-eval.yaml dist/index.js
  • eval:reportnode evaluations/scripts/generate-report.js
  • fix:rest-authbash scripts/fix-rest-api-auth.sh
  • formatprettier --write *.md docs/**/*.md src/**/*.ts tests/**/*.ts
  • format:checkprettier --check *.md docs/**/*.md src/**/*.ts tests/**/*.ts
  • healthnode scripts/health-check.js
  • linteslint src/ tests/
  • lint:fixeslint src/ tests/ --fix
  • lint:mdmarkdownlint *.md docs/**/*.md
  • lint:md:fixmarkdownlint *.md docs/**/*.md --fix
  • pre-commitlint-staged
  • preparehusky
  • prepublishOnlynpm run build && npm run check:ignore
  • releasesemantic-release
  • release:drysemantic-release --dry-run
  • …and 41 more.
Dependencies5
  • @modelcontextprotocol/sdk^1.29.0
  • dotenv^17.3.1
  • form-data^4.0.5
  • googleapis^171.4.0
  • zod^4.3.6