PkgRadar

Package evidence

@decaf-ts/[email protected]

Credential File Packaged: package/docker/.env

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
111Mature · −50% score
First published
Oct 2024
Publisher
tvenceslau

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@decaf-ts/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@decaf-ts/[email protected]"],"fail_on":"high"}'
Publishertvenceslau
Artifact bytes163,702
Previous version0.12.0
Published2026-05-10T03:17:02.685Z
SHA-256f56765ce77c079d93e9c025206911b3b46b63c5f432fded3194fba52efd67f09

Why flagged

What the scanner saw

Credential File Packaged: package/docker/.env

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
23Score
0.13.0Version
Status history (1 event)
  1. new → available · risk high · score 23 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential File Packagedpackage/docker/.envpackage/docker/.env35
mediumRemote Payloadpackage/docker/init-cluster.shmatched "curl "12

Manifest

Package metadata

Scripts39
  • buildbuild-scripts --dev
  • build:prodbuild-scripts --prod
  • clean-publishnpx clean-publish
  • coveragerimraf ./workdocs/reports/data/*.json && npm run test:all -- --coverage --config=./workdocs/reports/jest.coverage.config.cjs
  • do-installNPM_TOKEN=$(cat .npmtoken) npm install
  • docker:buildnpm run docker:build-booter && npm run docker:build-couchdb
  • docker:build-booterdocker build -t ghcr.io/decaf-ts/couchdb-booter:$(cat package.json | jq -r '.version') -t ghcr.io/decaf-ts/couchdb-booter:latest -f ./docker/Dockerfile-booter ./docker
  • docker:build-couchdbdocker build -t ghcr.io/decaf-ts/couchdb:$(cat package.json | jq -r '.version') -t ghcr.io/decaf-ts/couchdb:latest -f ./docker/Dockerfile-couchdb ./docker
  • docker:loginecho $(cat .token) | docker login ghcr.io -u decaf --password-stdin
  • docker:publishnpm run docker:publish-booter && npm run docker:publish-couchdb
  • docker:publish-booterdocker push ghcr.io/decaf-ts/couchdb-booter:$(cat package.json | jq -r '.version') && docker push ghcr.io/decaf-ts/couchdb-booter:latest
  • docker:publish-couchdbdocker push ghcr.io/decaf-ts/couchdb:$(cat package.json | jq -r '.version') && docker push ghcr.io/decaf-ts/couchdb:latest
  • docsnpx rimraf ./docs && mkdir docs && build-scripts --docs
  • drawingsfor FILE in workdocs/drawings/*.drawio; do echo "converting $FILE to image..." && docker run --rm -v $(pwd):/data rlespinasse/drawio-export --format png $FILE; done && cp -rf workdocs/drawings/export/* workdocs/resources/
  • flash-forwardnpx npm-check-updates -u && npm run do-install
  • linteslint .
  • lint-fixeslint --fix .
  • on-first-runnpx update-scripts --boot
  • prepare-prnpm run lint-fix && npm run build:prod && npm run coverage && npm run docs
  • prepare-releasenpm run lint-fix && npm run build:prod && npm run coverage && npm run docs
  • publish-docsdocker run -it --rm --user $(id -u):$(id -g) -v "$(pwd)/workdocs/confluence:/content" -e ATLASSIAN_API_TOKEN=$(cat .confluence-token) ghcr.io/markdown-confluence/publish:latest
  • release./bin/tag-release.sh
  • repo:doccodex exec "$(cat ./.codex/prompts/doc.md) $(cat ./.codex/prompts/bulk-docs.md) base_path is ./"
  • repo:initcodex exec "$(cat ./.codex/prompts/repo-setup.md) base_path is `./`, initialize the repository"
  • repo:prnpm run repo:doc && npm run repo:tests && npm run repo:readme
  • repo:readmecodex exec "$(cat ./.codex/prompts/update-readme.md) base_path is ./"
  • repo:setupcodex exec "$(cat ./.codex/prompts/repo-setup.md) base_path is ./"
  • repo:testscodex exec "$(cat ./.codex/prompts/bulk-tests.md) base_path is ./ and coverage is 95%" -s workspace-write
  • resetrm -rf * && git checkout . && git pull && npm run do-install
  • set-git-authgit config url."https://api:$(cat .token)@github.com/".insteadOf "https://github.com/" && git config url."https://ssh:$(cat .token)@github.com/".insteadOf "ssh://[email protected]/" && git config url."https://git:$(cat .token)@github.com/".insteadOf "[email protected]:"
  • …and 9 more.