Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@aperant/[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@aperant/[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Credential file access: matched ".npmrc"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 336 · status changed
Related candidates
Linked campaigns and clusters
andremik
3 members · evidence strength 74Evidence
Static findings
34 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/dist/cli/install/detached-spawn.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/src/cli/install/detached-spawn.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/dist/cli/install/home-stub.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/src/cli/install/home-stub.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/dist/cli/install/install-kernel.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/src/cli/install/install-kernel.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/dist/cli/risk/secrets.mjs | matched "aws_secret_access_key" | 30 |
| high | Credential file access | package/src/cli/risk/secrets.mjs | matched "aws_secret_access_key" | 30 |
| medium | Remote Payload | package/dist/cli/commands/roadmap.mjs | matched "curl " | 12 |
| medium | Remote Payload | package/src/cli/commands/roadmap.mjs | matched "curl " | 12 |
Show all 34 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/dist/cli/install/detached-spawn.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/src/cli/install/detached-spawn.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/dist/cli/install/home-stub.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/src/cli/install/home-stub.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/dist/cli/install/install-kernel.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/src/cli/install/install-kernel.mjs | matched ".npmrc" | 30 |
| high | Credential file access | package/dist/cli/risk/secrets.mjs | matched "aws_secret_access_key" | 30 |
| high | Credential file access | package/src/cli/risk/secrets.mjs | matched "aws_secret_access_key" | 30 |
| medium | Remote Payload | package/dist/cli/commands/roadmap.mjs | matched "curl " | 12 |
| medium | Remote Payload | package/src/cli/commands/roadmap.mjs | matched "curl " | 12 |
| low | Obfuscation | package/dist/capture/cdp-adapter.js | matched "Buffer.from(params.data, 'base64" | 3 |
| low | Obfuscation | package/dist/cli/output-style/ansi.mjs | matched "\\x1b" | 3 |
| low | Obfuscation | package/src/cli/output-style/ansi.mjs | matched "\\x1b" | 3 |
| low | Obfuscation | package/bin/apt-proof-video.mjs | matched "Buffer.from(data, 'base64" | 3 |
| low | Obfuscation | package/dist/cli/util/banner.mjs | matched "\\x1b" | 3 |
| low | Obfuscation | package/src/cli/util/banner.mjs | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/cli/commands/health-check.mjs | matched "\\x00" | 3 |
| low | Obfuscation | package/src/cli/commands/health-check.mjs | matched "\\x00" | 3 |
| low | Obfuscation | package/dist/cli/task/index-md.mjs | matched "\\u25b6" | 3 |
| low | Obfuscation | package/src/cli/task/index-md.mjs | matched "\\u25b6" | 3 |
| low | Obfuscation | package/dist/cli/roadmap/render.mjs | matched "\\u25cb" | 3 |
| low | Obfuscation | package/dist/cli/seeds/render.mjs | matched "\\u0000" | 3 |
| low | Obfuscation | package/src/cli/roadmap/render.mjs | matched "\\u25cb" | 3 |
| low | Obfuscation | package/src/cli/seeds/render.mjs | matched "\\u0000" | 3 |
| low | Obfuscation | package/dist/cli/commands/seed.mjs | matched "\\u0000" | 3 |
| low | Obfuscation | package/src/cli/commands/seed.mjs | matched "\\u0000" | 3 |
| low | Obfuscation | package/dist/cli/commands/statusline.mjs | matched "\\x1b" | 3 |
| low | Obfuscation | package/src/cli/commands/statusline.mjs | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/cli/install/update-chips.mjs | matched "\\x1b" | 3 |
| low | Obfuscation | package/src/cli/install/update-chips.mjs | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/cli/seeds/validate.mjs | matched "\\u0000" | 3 |
| low | Obfuscation | package/src/cli/seeds/validate.mjs | matched "\\u0000" | 3 |
| low | Obfuscation | package/dist/cli/commands/worktree-install.mjs | matched "fromCharCode" | 3 |
| low | Obfuscation | package/src/cli/commands/worktree-install.mjs | matched "fromCharCode" | 3 |
Manifest
Package metadata
Scripts13
buildtsc && node scripts/extract-personas-schema.mjsbuild-pluginnode scripts/build-plugin.mjsc28:cutovernode scripts/c28-cutover.mjscleanrm -rf distdevtsc --watch --preserveWatchOutputlintbiome check . --diagnostic-level=errorlint:fixbiome check --write . --diagnostic-level=errorpublish-pluginnode scripts/publish-plugin.mjspublish:verdaccionode scripts/publish-verdaccio.mjsrelease:verdacciopnpm build && pnpm publish:verdaccioship:verdaccionpm version patch --no-git-tag-version && pnpm build && pnpm publish:verdacciotestvitest runtypechecktsc --noEmit
Dependencies4
@clack/prompts^1.2.0proper-lockfile^4.1.2yaml^2.8.3zod^4.3.6
Optional dependencies5
@babel/parser^7.29.2@babel/traverse^7.29.0@google/genai^1.50.1css-tree^3.2.1playwright^1.59.1