Package evidence

@decaf-ts/[email protected]

Credential file access: matched "NPM_TOKEN"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 670
Versions published: 107Mature · −50% score
First published: Apr 2025
Publisher: tvenceslau

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@decaf-ts/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@decaf-ts/[email protected]"],"fail_on":"review"}'

Publishertvenceslau

Artifact bytes355,213

Previous version1.5.6

Published2026-06-04T11:40:41.317Z

SHA-256e189dbb3d83bc92d9dc95380499466bea8da7bf7ca43bfe00aeb353ada25907d

Why flagged

What the scanner saw

Credential file access: matched "NPM_TOKEN"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

13d agoLast checked

reviewRisk

39Score

1.6.0Version

Status history (1 event)

new → available13d ago · risk review · score 39 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Credential file access	package/lib/esm/cli/commands/tag-release-shell.js	matched "NPM_TOKEN"	30
medium	Remote Payload	package/lib/cjs/release-chain/index.cjs	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/dist/utils.cjs	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/lib/esm/release-chain/index.js	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/dist/utils.js	matched "raw.githubusercontent.com"	12

Manifest

Package metadata

Scripts33

add:shebangsed -i -e '1i#!/usr/bin/env node\' ./lib/cjs/bin/*.cjs && chmod +x lib/cjs/bin/*.cjs
buildtsx ./src/bin/build-scripts.ts --dev && npm run add:shebang
build:prodtsx ./src/bin/build-scripts.ts --prod && npm run add:shebang
clean-publishnpx clean-publish
coveragerimraf ./workdocs/reports/data/*.json && npm run test:all -- --coverage --config=./workdocs/reports/jest.coverage.config.cjs
do-installNPM_TOKEN=$(cat .npmtoken) npm install
docsnpx rimraf ./docs && mkdir docs && tsx ./src/bin/build-scripts.ts --docs
drawingsfor FILE in workdocs/drawings/*.drawio; do echo "converting $FILE to image..." && docker run --rm -v $(pwd):/data rlespinasse/drawio-export --format png $FILE; done && cp -rf workdocs/drawings/export/* workdocs/resources/
flash-forwardnpx npm-check-updates -u && npm run do-install
linteslint .
lint-fixeslint --fix .
on-first-runnode ./bin/update-scripts.cjs --boot
prepare-prnpm run lint-fix && npm run build:prod && npm run coverage && npm run docs
prepare-releasenpm run lint-fix && npm run build:prod && npm run coverage && npm run docs
publish-docsdocker run -it --rm --user $(id -u):$(id -g) -v "$(pwd)/workdocs/confluence:/content" -e ATLASSIAN_API_TOKEN=$(cat .confluence-token) ghcr.io/markdown-confluence/publish:latest
release./bin/tag-release.sh
repo:doccodex exec "$(cat ./.codex/prompts/doc.md) $(cat ./.codex/prompts/bulk-docs.md) base_path is ./"
repo:initcodex exec "$(cat ./.codex/prompts/repo-setup.md) base_path is `./`, initialize the repository"
repo:prnpm run repo:doc && npm run repo:tests && npm run repo:readme
repo:readmecodex exec "$(cat ./.codex/prompts/update-readme.md) base_path is ./"
repo:setupcodex exec "$(cat ./.codex/prompts/repo-setup.md) base_path is ./"
repo:testscodex exec "$(cat ./.codex/prompts/bulk-tests.md) base_path is ./ and coverage is 95%" -s workspace-write
resetrm -rf * && git checkout . && git pull && npm run do-install
set-git-authgit config url."https://api:$(cat .token)@github.com/".insteadOf "https://github.com/" && git config url."https://ssh:$(cat .token)@github.com/".insteadOf "ssh://[email protected]/" && git config url."https://git:$(cat .token)@github.com/".insteadOf "[email protected]:"
sync-codex./bin/sync-codex.sh
testjest --runInBand --detectOpenHandles
test:alljest --testPathPatterns="/tests" --passWithNoTests
test:circulardpdm -T --no-warning --no-tree ./src/index.ts
test:integrationjest --testPathPatterns="/tests/(integration)" --passWithNoTests --detectOpenHandles
test:unitjest --testPathPatterns="/tests/unit" --passWithNoTests --detectOpenHandles
…and 3 more.

Dependencies38

@decaf-ts/logginglatest
@eslint/js^9.25.1
@rollup/plugin-commonjs^29.0.2
@rollup/plugin-json^6.1.0
@rollup/plugin-node-resolve^16.0.3
@rollup/plugin-terser^1.0.0
@rollup/plugin-typescript^12.3.0
@stylistic/eslint-plugin^4.2.0
@types/jest30.0.0
@types/prompts^2.4.9
@types/shell-quote^1.7.5
clean-publish^5.1.0
dpdm^3.14.0
eslint^9.25.1
eslint-config-prettier^10.1.2
eslint-plugin-prettier^5.2.6
globals^16.0.0
jest30.4.2
jest-html-reporters3.1.7
jest-junit17.0.0
jsdoc^4.0.4
jsdoc-mermaid^1.0.0
markdown-include^0.4.3
minimist^1.2.8
nodemon^3.1.9
npm-check-updates^18.0.0
prettier3.5.3
prompts^2.4.2
rimraf^6.0.1
rollup^4.59.0
…and 8 more.