Package evidence

@flexspec/[email protected]

Credential file access: matched ".ssh/"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 2
First published: May 2026
Publisher: joshk418

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@flexspec/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@flexspec/[email protected]"],"fail_on":"review"}'

Publisherjoshk418

Artifact bytes7,787,898

Previous versionnone

Published2026-05-29T04:15:17.201Z

SHA-256abc0ca0c15ca3311e1ee87477504c815974c1e7cb37989cea3820b63f4e82d34

Why flagged

What the scanner saw

Credential file access: matched ".ssh/"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

15d agoLast checked

reviewRisk

5Score

0.3.0Version

Status history (1 event)

new → available15d ago · risk review · score 5 · status changed

Evidence

Static findings

6 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 6 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Credential file access	package/dist/assets/ssh-config-_ykCGR6B.js	matched ".ssh/"	5
low	Obfuscation Density	package/dist/assets/chunk-B4BG7PRW-9rQnIr-C.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/chunk-B4BG7PRW-B0qaqHeP.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/assets/flowDiagram-NV44I4VS-Sv2_zfem.js	high encoded/escaped-token density	0
low	Large Javascript Payload	package/dist/index--3YlHFQS.js	2182146 bytes	0
low	Large Javascript Payload	package/dist/assets/index-CF6tJp1y.js	3362329 bytes	0

Manifest

Package metadata

Scripts7

buildtsc -b && vite build && vite build -c vite.lib.config.ts
devvite --port 5173
linteslint .
previewvite preview --port 4173
testvitest run
test:watchvitest
typechecktsc --noEmit

Dependencies70

@ai-sdk/react^3.0.41
@dagrejs/dagre^1.1.8
@exuanbo/file-icons-js^3.3.0
@flexspec/http-server0.3.0
@radix-ui/react-accordion^1.2.12
@radix-ui/react-avatar^1.1.11
@radix-ui/react-collapsible^1.1.12
@radix-ui/react-dialog^1.1.15
@radix-ui/react-dropdown-menu^2.1.16
@radix-ui/react-hover-card^1.1.15
@radix-ui/react-popover^1.1.15
@radix-ui/react-progress^1.1.8
@radix-ui/react-scroll-area^1.2.10
@radix-ui/react-select^2.2.6
@radix-ui/react-separator^1.1.8
@radix-ui/react-slot^1.2.4
@radix-ui/react-switch^1.2.6
@radix-ui/react-tabs^1.1.13
@radix-ui/react-toast^1.2.8
@radix-ui/react-tooltip^1.2.8
@radix-ui/react-use-controllable-state^1.2.2
@rive-app/react-webgl2^4.26.1
@streamdown/cjk^1.0.1
@streamdown/code^1.0.1
@streamdown/math^1.0.1
@streamdown/mermaid^1.0.1
@tanstack/react-query^5.90.20
@xyflow/react^12.10.0
ai^6.0.39
ai-elements^1.8.0
…and 40 more.