Package evidence

@checkstack/[email protected]

Credential file access: matched ".npmrc"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 16
First published: May 2026
Publisher: enyineer

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@checkstack/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@checkstack/[email protected]"],"fail_on":"review"}'

Publisherenyineer

Artifact bytes117,054

Previous version0.3.12

Published2026-06-14T21:55:56.697Z

SHA-2562d7eda621bec685a289df559314f6661020cd464229cf208159a322a7845dcde

Why flagged

What the scanner saw

Credential file access: matched ".npmrc"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

2d agoLast checked

reviewRisk

30Score

0.3.13Version

Status history (1 event)

new → available2d ago · risk review · score 30 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Credential file access	package/src/audit-scanner.ts	matched ".npmrc"	10
medium	Credential file access	package/src/resolver.test.ts	matched ".npmrc"	10
medium	Credential file access	package/src/resolver.ts	matched ".npmrc"	10

Manifest

Package metadata

Scripts4

lintbun run lint:code
lint:codeeslint . --max-warnings 0
testbun test
typechecktsgo -b

Dependencies11

@checkstack/auth-common0.10.0
@checkstack/backend-api0.24.0
@checkstack/common0.16.0
@checkstack/notification-common1.3.4
@checkstack/script-packages-common0.3.4
@checkstack/sdk0.109.1
@checkstack/secrets-backend0.2.10
@checkstack/secrets-common0.2.4
@orpc/server^1.14.4
drizzle-orm^0.45.0
zod^4.0.0