PkgRadar

Package evidence

@decaf-ts/[email protected]

Credential file access: matched "GITHUB_TOKEN"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@decaf-ts/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@decaf-ts/[email protected]"],"fail_on":"high"}'
Publishertvenceslau
Artifact bytes339,702
Previous version1.3.2
Published2026-05-21T10:43:06.391Z
SHA-256696998f10ff26ba69986014a04ae638e7fa6d130b73445fcbb4708dfc40457a4

Why flagged

What the scanner saw

Credential file access: matched "GITHUB_TOKEN"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
396Score
1.5.1Version
Status history (1 event)
  1. new → available · risk high · score 396 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

tvenceslau

8 members · evidence strength 84

Evidence

Static findings

24 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential file accesspackage/lib/cjs/release-chain/index.cjsmatched "GITHUB_TOKEN"30
highCredential file accesspackage/lib/cjs/cli/commands/tag-release-shell.cjsmatched "NPM_TOKEN"30
highCredential file accesspackage/lib/cjs/cli/commands/tag-release.cjsmatched "NPM_TOKEN"30
highCredential file accesspackage/dist/utils.cjsmatched "GITHUB_TOKEN"30
highCredential file accesspackage/lib/esm/release-chain/index.jsmatched "GITHUB_TOKEN"30
highCredential file accesspackage/lib/esm/cli/commands/tag-release-shell.jsmatched "NPM_TOKEN"30
highCredential file accesspackage/lib/esm/cli/commands/tag-release.jsmatched "NPM_TOKEN"30
highCredential file accesspackage/dist/utils.jsmatched "NPM_TOKEN"30
highCredential file accesspackage/package.jsonmatched "NPM_TOKEN"30
highCredential file accesspackage/bin/tag-release.shmatched "NPM_TOKEN"30
mediumRemote Payloadpackage/lib/cjs/release-chain/index.cjsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/utils.cjsmatched "raw.githubusercontent.com"12
mediumObfuscation Densitypackage/dist/utils.cjshigh encoded/escaped-token density12
mediumRemote Payloadpackage/lib/esm/release-chain/index.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/utils.jsmatched "raw.githubusercontent.com"12
mediumObfuscation Densitypackage/dist/utils.jshigh encoded/escaped-token density12
Show all 24 findings (low-signal and informational)
SeverityKindPathDetailPoints
highCredential file accesspackage/lib/cjs/release-chain/index.cjsmatched "GITHUB_TOKEN"30
highCredential file accesspackage/lib/cjs/cli/commands/tag-release-shell.cjsmatched "NPM_TOKEN"30
highCredential file accesspackage/lib/cjs/cli/commands/tag-release.cjsmatched "NPM_TOKEN"30
highCredential file accesspackage/dist/utils.cjsmatched "GITHUB_TOKEN"30
highCredential file accesspackage/lib/esm/release-chain/index.jsmatched "GITHUB_TOKEN"30
highCredential file accesspackage/lib/esm/cli/commands/tag-release-shell.jsmatched "NPM_TOKEN"30
highCredential file accesspackage/lib/esm/cli/commands/tag-release.jsmatched "NPM_TOKEN"30
highCredential file accesspackage/dist/utils.jsmatched "NPM_TOKEN"30
highCredential file accesspackage/package.jsonmatched "NPM_TOKEN"30
highCredential file accesspackage/bin/tag-release.shmatched "NPM_TOKEN"30
mediumRemote Payloadpackage/lib/cjs/release-chain/index.cjsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/utils.cjsmatched "raw.githubusercontent.com"12
mediumObfuscation Densitypackage/dist/utils.cjshigh encoded/escaped-token density12
mediumRemote Payloadpackage/lib/esm/release-chain/index.jsmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/dist/utils.jsmatched "raw.githubusercontent.com"12
mediumObfuscation Densitypackage/dist/utils.jshigh encoded/escaped-token density12
lowObfuscationpackage/lib/cjs/output/common.cjsmatched "\\x1b"3
lowObfuscationpackage/lib/cjs/assets/slogans.cjsmatched "\\u2019"3
lowObfuscationpackage/dist/utils.cjsmatched "\\u2019"3
lowObfuscationpackage/lib/esm/output/common.jsmatched "\\x1b"3
lowObfuscationpackage/lib/esm/assets/slogans.jsmatched "\\u2019"3
lowObfuscationpackage/dist/utils.jsmatched "\\u2019"3
lowObfuscationpackage/dist/assets/slogans.tsmatched "\\u2019"3
lowObfuscationpackage/lib/assets/slogans.tsmatched "\\u2019"3

Manifest

Package metadata

Scripts33
  • add:shebangsed -i -e '1i#!/usr/bin/env node\' ./lib/cjs/bin/*.cjs && chmod +x lib/cjs/bin/*.cjs
  • buildtsx ./src/bin/build-scripts.ts --dev && npm run add:shebang
  • build:prodtsx ./src/bin/build-scripts.ts --prod && npm run add:shebang
  • clean-publishnpx clean-publish
  • coveragerimraf ./workdocs/reports/data/*.json && npm run test:all -- --coverage --config=./workdocs/reports/jest.coverage.config.cjs
  • do-installNPM_TOKEN=$(cat .npmtoken) npm install
  • docsnpx rimraf ./docs && mkdir docs && tsx ./src/bin/build-scripts.ts --docs
  • drawingsfor FILE in workdocs/drawings/*.drawio; do echo "converting $FILE to image..." && docker run --rm -v $(pwd):/data rlespinasse/drawio-export --format png $FILE; done && cp -rf workdocs/drawings/export/* workdocs/resources/
  • flash-forwardnpx npm-check-updates -u && npm run do-install
  • linteslint .
  • lint-fixeslint --fix .
  • on-first-runnode ./bin/update-scripts.cjs --boot
  • prepare-prnpm run lint-fix && npm run build:prod && npm run coverage && npm run docs
  • prepare-releasenpm run lint-fix && npm run build:prod && npm run coverage && npm run docs
  • publish-docsdocker run -it --rm --user $(id -u):$(id -g) -v "$(pwd)/workdocs/confluence:/content" -e ATLASSIAN_API_TOKEN=$(cat .confluence-token) ghcr.io/markdown-confluence/publish:latest
  • release./bin/tag-release.sh
  • repo:doccodex exec "$(cat ./.codex/prompts/doc.md) $(cat ./.codex/prompts/bulk-docs.md) base_path is ./"
  • repo:initcodex exec "$(cat ./.codex/prompts/repo-setup.md) base_path is `./`, initialize the repository"
  • repo:prnpm run repo:doc && npm run repo:tests && npm run repo:readme
  • repo:readmecodex exec "$(cat ./.codex/prompts/update-readme.md) base_path is ./"
  • repo:setupcodex exec "$(cat ./.codex/prompts/repo-setup.md) base_path is ./"
  • repo:testscodex exec "$(cat ./.codex/prompts/bulk-tests.md) base_path is ./ and coverage is 95%" -s workspace-write
  • resetrm -rf * && git checkout . && git pull && npm run do-install
  • set-git-authgit config url."https://api:$(cat .token)@github.com/".insteadOf "https://github.com/" && git config url."https://ssh:$(cat .token)@github.com/".insteadOf "ssh://[email protected]/" && git config url."https://git:$(cat .token)@github.com/".insteadOf "[email protected]:"
  • sync-codex./bin/sync-codex.sh
  • testjest --runInBand --detectOpenHandles
  • test:alljest --testPathPatterns="/tests" --passWithNoTests
  • test:circulardpdm -T --no-warning --no-tree ./src/index.ts
  • test:integrationjest --testPathPatterns="/tests/(integration)" --passWithNoTests --detectOpenHandles
  • test:unitjest --testPathPatterns="/tests/unit" --passWithNoTests --detectOpenHandles
  • …and 3 more.
Dependencies38
  • @decaf-ts/logginglatest
  • @eslint/js^9.25.1
  • @rollup/plugin-commonjs^29.0.2
  • @rollup/plugin-json^6.1.0
  • @rollup/plugin-node-resolve^16.0.3
  • @rollup/plugin-terser^1.0.0
  • @rollup/plugin-typescript^12.3.0
  • @stylistic/eslint-plugin^4.2.0
  • @types/jest^30.0.0
  • @types/prompts^2.4.9
  • @types/shell-quote^1.7.5
  • clean-publish^5.1.0
  • dpdm^3.14.0
  • eslint^9.25.1
  • eslint-config-prettier^10.1.2
  • eslint-plugin-prettier^5.2.6
  • globals^16.0.0
  • jest^30.2.0
  • jest-html-reporters^3.1.7
  • jest-junit^17.0.0
  • jsdoc^4.0.4
  • jsdoc-mermaid^1.0.0
  • markdown-include^0.4.3
  • minimist^1.2.8
  • nodemon^3.1.9
  • npm-check-updates^18.0.0
  • prettier3.5.3
  • prompts^2.4.2
  • rimraf^6.0.1
  • rollup^4.59.0
  • …and 8 more.