Package evidence

@cyaxios/[email protected]

Suspicious Publish Context: {"package_age_days":0,"publisher":"cygms","burst_same_day":2,"burst_week":2,"lure":null,"version_anomaly":false,"new_account":false}

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 2
First published: Jun 2026
Publisher: cygms

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@cyaxios/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@cyaxios/[email protected]"],"fail_on":"review"}'

Publishercygms

Artifact bytes1,998,156

Previous version0.6.0-alpha.3

Published2026-06-12T19:07:36.318Z

SHA-2564828684f13df2de20e0ae8f0108a21be32b6bd0fe5be84eff3a9d1e4c0e20a40

Why flagged

What the scanner saw

Suspicious Publish Context: {"package_age_days":0,"publisher":"cygms","burst_same_day":2,"burst_week":2,"lure":null,"version_anomaly":false,"new_account":false}

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

6h agoLast checked

reviewRisk

10Score

0.6.0-alpha.4Version

Status history (1 event)

new → available6h ago · risk review · score 10 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Suspicious Publish Context	manifest	{"package_age_days":0,"publisher":"cygms","burst_same_day":2,"burst_week":2,"lure":null,"version_anomaly":false,"new_account":false}	10

Manifest

Package metadata

Scripts12

buildtsc -p tsconfig.json
build:browsernpm run build && node scripts/build-browser-bundle.mjs
formatprettier --write src test bin
format:checkprettier --check src test bin
linteslint --max-warnings=0 src test bin
lint:fixeslint --fix src test bin
pretestnpm run build
testnode --import tsx --import ./test/_setup_wasm.mjs --test test/sdk_smoke.test.ts test/module_surface.test.ts test/node_runtime.test.ts test/handlers.test.ts test/handlers_fs_drop.test.ts test/handlers_fs_scan.test.ts test/handlers_vault_push.test.ts test/handlers_vault_pull.test.ts test/init_idempotence.test.ts test/client.test.ts test/client_ephemeral.test.ts test/config_env_vars.test.ts test/load_config_shape.test.ts test/yaml_vault_model.test.ts test/vault_normalize_contract.test.ts test/create_fresh_vault_yaml.test.ts test/multi_group_routing.test.ts test/tnpkg_export_absorb.test.ts test/tnpkg_interop.test.ts test/manifest_contract.test.ts test/tnpkg_container_contract.test.ts test/body_encryption_contract.test.ts test/recipient_seal.test.ts test/absorb_vault_adoption_contract.test.ts test/admin_cache.test.ts test/admin_cache_load.test.ts test/admin_state_apply.test.ts test/leaf_reuse_equivocation.test.ts test/awk_bek_parity.test.ts test/read_shape.test.ts test/agents_group.test.ts test/secure_read.test.ts test/admin_add_agent_runtime.test.ts test/agents_policy_published.test.ts test/secure_read_interop.test.ts test/sync_state.test.ts test/core_no_node_imports.test.ts test/errors_instanceof.test.ts test/tn_init.test.ts test/admin_namespace.test.ts test/admin_recipient_polymorphic.test.ts test/pkg_namespace.test.ts test/vault_namespace.test.ts test/agents_namespace.test.ts test/handlers_namespace.test.ts test/emk.test.ts test/watch.test.ts test/cli_watch.test.ts test/cli_rotate.test.ts test/watch_interop.test.ts test/core_browser_contract.test.ts test/decrypt_raw.test.ts test/btn_wire_contract.test.ts test/tn_multi_ceremony.test.ts test/extends_loader.test.ts test/ensure_group_stream_layout.test.ts test/log_path_event_id.test.ts test/project_stream_layout_contract.test.ts test/project_layout_create_runtime.test.ts test/ceremony_init_row_hash_parity.test.ts test/profiles.test.ts test/profile_chain_parity.test.ts test/profile_conflict.test.ts test/runtime_dedup.test.ts test/stdout_pretty.test.ts test/cli_streams_validate.test.ts test/emit_propagation.test.ts test/identity_project_seed.test.ts test/dirt_easy_flow.test.ts test/scenarios/alice/s01_hello.test.ts test/scenarios/alice/s02_rotate.test.ts test/scenarios/alice/s03_ceremony_matrix.test.ts test/scenarios/alice/s04_context_scopes.test.ts test/scenarios/alice/s06_rollover.test.ts test/scenarios/alice/s07_field_routing.test.ts test/scenarios/alice/s08_resume.test.ts test/scenarios/alice/s09_multi_recipient.test.ts test/scenarios/examples/ex02_reading.test.ts test/scenarios/examples/ex03_groups.test.ts test/scenarios/examples/ex06_multi_handler.test.ts test/vault_client_auth.test.ts test/wallet_link.test.ts test/account_connect.test.ts test/account_connect_cascade.test.ts test/cli_init_vault_show.test.ts test/cli_wallet_account.test.ts test/wallet_restore.test.ts test/init_upload.test.ts test/identity.test.ts test/filter_grammar.test.ts test/firehose_handler.test.ts test/restore_loopback.test.ts test/absorb_sealed_bootstrap.test.ts test/outbox.test.ts test/Entry.test.ts test/absorb_replaced_kit_paths.test.ts test/cross_publisher_read.test.ts test/log_fields.test.ts test/yaml_stdout_authoritative.test.ts test/log_level_filter.test.ts test/context_verbs.test.ts test/stdout_handler.test.ts test/run_set_guard.test.ts test/yaml_path_portability.test.ts test/using_rust.test.ts test/module_surface_parity.test.ts test/vault_emit_parity.test.ts test/e2e_docker.test.ts test/local_ndjson.test.ts test/local_keystore.test.ts test/local_envelope.test.ts test/local_read.test.ts test/local_watch.test.ts test/local_surface.test.ts test/wallet_status.test.ts test/wallet_namespace.test.ts test/cli_bundle.test.ts test/cli_add_recipient.test.ts test/cli_group_add.test.ts test/cli_absorb.test.ts test/cli_show_profiles.test.ts test/cli_wallet_pull_prefs.test.ts test/cli_wallet_export_mnemonic.test.ts test/cli_firehose.test.ts test/cli_wallet_sync.test.ts test/cli_inbox_accept.test.ts test/cli_inbox_list_local.test.ts test/verify_roundtrip.test.ts test/secure_read_tamper.test.ts test/wallet_sync_live.test.ts test/wallet_restore_live.test.ts test/account_connect_live.test.ts test/wallet_lifecycle_live.test.ts test/wallet_sync_negatives_live.test.ts test/wallet_two_device_sync_live.test.ts test/wallet_two_device_group_sync_live.test.ts test/account_sync_full_live.test.ts test/account_sync_cross_impl_live.test.ts test/cross_impl_body_roundtrip_live.test.ts test/awk_cache_live.test.ts test/btn_rotation_read.test.ts test/btn_genesis_anchor.test.ts test/btn_promote_crash.test.ts test/version_parity.test.ts
test:allbash test/interop_driver.sh
test:coveragec8 --reporter=text --reporter=lcov --include=src/**/*.ts --exclude=src/**/*.d.ts --all npm test
test:interopnode test/interop_driver.mjs
typechecktsc --noEmit -p tsconfig.json

Dependencies6

@noble/curves^1.9.7
@noble/hashes^1.8.0
chokidar^4.0.3
fflate^0.8.2
tn-wasmfile:../crypto/tn-wasm/pkg
yaml^2.6.0