Package evidence

@dvai-bridge/[email protected]

Known Indicator Filename: package/android/src/main/cpp/native/llama.cpp/tools/server/public/bundle.js

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@dvai-bridge/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@dvai-bridge/[email protected]"],"fail_on":"high"}'

Publisherdk013

Artifact bytes34,231,495

Previous versionnone

Published2026-05-16T17:31:36.770Z

SHA-256f097d6d3f5fe5d17d2f1f9c9a52d9fe2cdc3a1a175bdc61952ac968a76504534

Why flagged

What the scanner saw

Known Indicator Filename: package/android/src/main/cpp/native/llama.cpp/tools/server/public/bundle.js

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

20d agoLast checked

highRisk

610Score

4.0.0Version

Status history (1 event)

new → available20d ago · risk high · score 610 · status changed

Evidence

Static findings

52 static · 0 from release diff · showing high-signal first.

Showing 30 of 37 findings.

Severity	Kind	Path	Detail	Points
high	Known Indicator Filename	package/android/src/main/cpp/native/llama.cpp/tools/server/public/bundle.js	package/android/src/main/cpp/native/llama.cpp/tools/server/public/bundle.js	45
high	Credential file access	package/android/src/main/cpp/native/llama.cpp/.github/workflows/ai-issues.yml	matched "GITHUB_TOKEN"	30
high	Credential file access	package/android/src/main/cpp/native/llama.cpp/.github/workflows/close-issue.yml	matched "github_token"	30
high	Credential file access	package/android/src/main/cpp/native/llama.cpp/.github/workflows/docker.yml	matched "github_token"	30
high	Credential file access	package/android/src/main/cpp/native/llama.cpp/.github/workflows/release.yml	matched "github_token"	30
high	Credential file access	package/android/src/main/cpp/native/llama.cpp/.github/workflows/winget.yml	matched "GITHUB_TOKEN"	30
medium	Obfuscation Density	package/android/src/main/cpp/native/llama.cpp/tools/server/webui/package-lock.json	high encoded/escaped-token density	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/compare-logprobs.py	matched "raw.githubusercontent.com"	12
medium	Obfuscation Density	package/android/src/main/cpp/native/llama.cpp/gguf-py/gguf/quants.py	high encoded/escaped-token density	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/snapdragon/qdc/tests/run_bench_tests_posix.py	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/sync_vendor.py	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/tools/server/tests/utils.py	matched "wget\r\n\r\n\r\n"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/tools/server/chat-llama2.sh	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/tools/server/chat.sh	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/examples/model-conversion/scripts/utils/curl-embedding-server.sh	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/get-hellaswag.sh	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/get-pg.sh	matched "curl\r\n"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/get-wikitext-2.sh	matched "wget "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/get-winogrande.sh	matched "wget "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/hf.sh	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/pr2wt.sh	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/ci/run.sh	matched "wget "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/tools/server/webui/src/lib/services/mcp.service.ts	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/actions/install-exe/action.yml	matched "Invoke-WebRequest"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/actions/unarchive-tar/action.yml	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/actions/windows-setup-cuda/action.yml	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/build-and-test-snapdragon.yml	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/build-cache.yml	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/build-self-hosted.yml	matched "github.com/google/dawn/releases/download"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/build-sycl.yml	matched "wget "	12

Show all 52 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Known Indicator Filename	package/android/src/main/cpp/native/llama.cpp/tools/server/public/bundle.js	package/android/src/main/cpp/native/llama.cpp/tools/server/public/bundle.js	45
high	Credential file access	package/android/src/main/cpp/native/llama.cpp/.github/workflows/ai-issues.yml	matched "GITHUB_TOKEN"	30
high	Credential file access	package/android/src/main/cpp/native/llama.cpp/.github/workflows/close-issue.yml	matched "github_token"	30
high	Credential file access	package/android/src/main/cpp/native/llama.cpp/.github/workflows/docker.yml	matched "github_token"	30
high	Credential file access	package/android/src/main/cpp/native/llama.cpp/.github/workflows/release.yml	matched "github_token"	30
high	Credential file access	package/android/src/main/cpp/native/llama.cpp/.github/workflows/winget.yml	matched "GITHUB_TOKEN"	30
medium	Obfuscation Density	package/android/src/main/cpp/native/llama.cpp/tools/server/webui/package-lock.json	high encoded/escaped-token density	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/compare-logprobs.py	matched "raw.githubusercontent.com"	12
medium	Obfuscation Density	package/android/src/main/cpp/native/llama.cpp/gguf-py/gguf/quants.py	high encoded/escaped-token density	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/snapdragon/qdc/tests/run_bench_tests_posix.py	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/sync_vendor.py	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/tools/server/tests/utils.py	matched "wget\r\n\r\n\r\n"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/tools/server/chat-llama2.sh	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/tools/server/chat.sh	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/examples/model-conversion/scripts/utils/curl-embedding-server.sh	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/get-hellaswag.sh	matched "raw.githubusercontent.com"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/get-pg.sh	matched "curl\r\n"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/get-wikitext-2.sh	matched "wget "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/get-winogrande.sh	matched "wget "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/hf.sh	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/scripts/pr2wt.sh	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/ci/run.sh	matched "wget "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/tools/server/webui/src/lib/services/mcp.service.ts	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/actions/install-exe/action.yml	matched "Invoke-WebRequest"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/actions/unarchive-tar/action.yml	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/actions/windows-setup-cuda/action.yml	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/build-and-test-snapdragon.yml	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/build-cache.yml	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/build-self-hosted.yml	matched "github.com/google/dawn/releases/download"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/build-sycl.yml	matched "wget "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/build-vulkan.yml	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/build.yml	matched "github.com/google/dawn/releases/download"	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/copilot-setup-steps.yml	matched "wget "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/release.yml	matched "wget "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/server-sanitize.yml	matched "curl "	12
medium	Remote Payload	package/android/src/main/cpp/native/llama.cpp/.github/workflows/server.yml	matched "curl "	12
medium	Large Javascript Payload	package/android/src/main/cpp/native/llama.cpp/tools/server/public/bundle.js	6509173 bytes	10
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/convert_hf_to_gguf.py	matched "\\xe2"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/convert_llama_ggml_to_gguf.py	matched "\\xe2"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/scripts/fetch_server_test_models.py	matched "eval("	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/examples/json_schema_to_grammar.py	matched "\\x7F"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/gguf-py/gguf/quants.py	matched "\\x00"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/scripts/server-test-function-call.py	matched "\\x1b"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/scripts/server-test-model.py	matched "\\x1B"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/scripts/server-test-parallel-tc.py	matched "\\x1b"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/scripts/server-test-structured.py	matched "\\x1b"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/tests/test-tokenizer-random.py	matched "\\uFFFD"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/tools/server/webui/src/lib/constants/key-value-pairs.ts	matched "\\x00"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/tools/server/webui/src/lib/constants/literal-html.ts	matched "\\u00a0"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/tools/server/webui/src/lib/utils/sanitize.ts	matched "\\x09"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/.github/workflows/build.yml	matched "\\x64"	3
low	Obfuscation	package/android/src/main/cpp/native/llama.cpp/.github/workflows/release.yml	matched "\\x64"	3