PkgRadar

Package evidence

@bigcommerce/[email protected]

Credential file access: matched ".npmrc"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
2,827Niche · −30% score
Versions published
186Mature · −50% score
First published
Oct 2016
Publisher
zoharmuzafi

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@bigcommerce/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@bigcommerce/[email protected]"],"fail_on":"review"}'
Publisherzoharmuzafi
Artifact bytes20,998,396
Previous version1.15.5
Published2019-03-08T21:32:54.173Z
SHA-256ea1ebd979ca173fd686b3f1cf72ee443f586531cafc1b0bc4011d4a4c8b9e26b

Why flagged

What the scanner saw

Credential file access: matched ".npmrc"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
18Score
1.15.6Version
Status history (1 event)
  1. new → available · risk review · score 18 · status changed

Evidence

Static findings

18 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumCredential file accesspackage/nvm/versions/node/v10.12.0/lib/node_modules/npm/lib/config/core.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v10.12.0/lib/node_modules/npm/lib/config/defaults.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v10.12.0/lib/node_modules/npm/node_modules/global-dirs/index.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v6.14.4/lib/node_modules/npm/lib/config/core.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v6.14.4/lib/node_modules/npm/lib/config/defaults.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v8.12.0/lib/node_modules/npm/lib/config/core.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v8.12.0/lib/node_modules/npm/lib/config/defaults.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v8.12.0/lib/node_modules/npm/node_modules/global-dirs/index.jsmatched ".npmrc"10
Show all 18 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumCredential file accesspackage/nvm/versions/node/v10.12.0/lib/node_modules/npm/lib/config/core.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v10.12.0/lib/node_modules/npm/lib/config/defaults.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v10.12.0/lib/node_modules/npm/node_modules/global-dirs/index.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v6.14.4/lib/node_modules/npm/lib/config/core.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v6.14.4/lib/node_modules/npm/lib/config/defaults.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v8.12.0/lib/node_modules/npm/lib/config/core.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v8.12.0/lib/node_modules/npm/lib/config/defaults.jsmatched ".npmrc"10
mediumCredential file accesspackage/nvm/versions/node/v8.12.0/lib/node_modules/npm/node_modules/global-dirs/index.jsmatched ".npmrc"10
lowCredential file accesspackage/nvm/versions/node/v10.12.0/lib/node_modules/npm/lib/npm.jsmatched ".npmrc"5
lowCredential file accesspackage/nvm/versions/node/v10.12.0/lib/node_modules/npm/node_modules/aws4/aws4.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/nvm/versions/node/v10.12.0/lib/node_modules/npm/node_modules/npm-packlist/index.jsmatched ".npmrc"5
lowCredential file accesspackage/nvm/versions/node/v6.14.4/lib/node_modules/npm/lib/npm.jsmatched ".npmrc"5
lowCredential file accesspackage/nvm/versions/node/v6.14.4/lib/node_modules/npm/lib/utils/tar.jsmatched ".npmrc"5
lowCredential file accesspackage/nvm/versions/node/v6.14.4/lib/node_modules/npm/node_modules/fstream-npm/fstream-npm.jsmatched ".npmrc"5
lowCredential file accesspackage/nvm/versions/node/v8.12.0/lib/node_modules/npm/lib/npm.jsmatched ".npmrc"5
lowCredential file accesspackage/nvm/versions/node/v8.12.0/lib/node_modules/npm/node_modules/aws4/aws4.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/nvm/versions/node/v8.12.0/lib/node_modules/npm/node_modules/npm-packlist/index.jsmatched ".npmrc"5
lowLarge Javascript Payloadpackage/server/plugins/stencil-editor/public/dist/app.js2859619 bytes0

Manifest

Package metadata

Scripts9
  • dumpconfenv | grep npm | sort | uniq
  • preparenode bin/npm-cli.js --no-audit --no-timing prune --prefix=. --no-global && rimraf test/*/*/node_modules && make -j4 doc
  • preversionbash scripts/update-authors.sh && git add AUTHORS && git commit -m "update AUTHORS" || true
  • taptap --reporter=classic --timeout 300
  • tap-covertap --reporter=classic --nyc-arg='--cache' --coverage --timeout 600
  • teststandard && npm run test-tap
  • test-coveragenpm run tap-cover -- "test/tap/*.js" "test/network/*.js" "test/broken-under-*/*.js"
  • test-nodetap --timeout 240 "test/tap/*.js" "test/network/*.js" "test/broken-under-nyc*/*.js"
  • test-tapnpm run tap -- "test/tap/*.js" "test/network/*.js" "test/broken-under-*/*.js"
Dependencies109
  • JSONStream^1.3.4
  • abbrev~1.1.1
  • ansicolors~0.3.2
  • ansistyles~0.1.3
  • aproba~1.2.0
  • archy~1.0.0
  • bin-links^1.1.2
  • bluebird~3.5.1
  • byte-size^4.0.3
  • cacache^11.2.0
  • call-limit~1.1.0
  • chownr~1.0.1
  • ci-info^1.4.0
  • cli-columns^3.1.2
  • cli-table3^0.5.0
  • cmd-shim~2.0.2
  • columnify~1.5.4
  • config-chain~1.1.11
  • detect-indent~5.0.0
  • detect-newline^2.1.0
  • dezalgo~1.0.3
  • editor~1.0.0
  • figgy-pudding^3.4.1
  • find-npm-prefix^1.0.2
  • fs-vacuum~1.2.10
  • fs-write-stream-atomic~1.0.10
  • gentle-fs^2.0.1
  • glob~7.1.2
  • graceful-fs~4.1.11
  • has-unicode~2.0.1
  • …and 79 more.