Package evidence
@florianpat/[email protected]
Known Indicator Filename: package/node_modules/@sigstore/bundle/dist/bundle.js
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Publisher
- GitHub ActionsTrusted automation · −70% score
Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@florianpat/[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@florianpat/[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Known Indicator Filename: package/node_modules/@sigstore/bundle/dist/bundle.js
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 2547 · status changed
Related candidates
Linked campaigns and clusters
Known Indicator Filename — package/node_modules/@sigstore/sign/dist/bundler/bundle.js
4 members · evidence strength 90Known Indicator Filename — package/node_modules/@sigstore/bundle/dist/bundle.js
4 members · evidence strength 90Evidence
Static findings
377 static · 0 from release diff · showing high-signal first.
Showing 30 of 82 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/node_modules/@sigstore/bundle/dist/bundle.js | package/node_modules/@sigstore/bundle/dist/bundle.js | 45 |
| high | Known Indicator Filename | package/node_modules/@sigstore/sign/dist/bundler/bundle.js | package/node_modules/@sigstore/sign/dist/bundler/bundle.js | 45 |
| high | Credential file access | package/builders/_lando.js | matched ".ssh" | 30 |
| high | Credential file access | package/hooks/app-check-ssh-keys.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/@npmcli/arborist/lib/consistent-resolve.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/@npmcli/arborist/lib/dep-valid.js | matched ".ssh" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/@npmcli/agent/lib/dns.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/retry/example/dns.js | matched "dns.resolve" | 30 |
| high | Credential file access | package/node_modules/node-forge/dist/forge.all.min.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/node-forge/dist/forge.min.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/pacote/lib/git.js | matched ".ssh" | 30 |
| high | Credential file access | package/sources/github.js | matched "id_rsa" | 30 |
| high | Credential file access | package/index.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/hosted-git-info/lib/index.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/is-lambda/index.js | matched ".AWS" | 30 |
| high | Credential file access | package/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/index.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/npm-packlist/lib/index.js | matched ".npmrc" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/socks-proxy-agent/dist/index.js | matched "dns.lookup" | 30 |
| high | Credential file access | package/components/l337-v4.js | matched ".ssh" | 30 |
| high | Credential file access | package/builders/lando-v4.js | matched ".npmrc" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/@sigstore/sign/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/npm-profile/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/npm-registry-fetch/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/sigstore/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/tuf-js/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | Credential file access | package/hooks/plugin-auth-from-npmrc.js | matched ".npmrc" | 30 |
| high | Credential file access | package/packages/ssh-agent/ssh-agent.js | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/node-forge/lib/ssh.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/is-lambda/test.js | matched ".AWS" | 30 |
Show all 377 findings (low-signal and informational)
Showing 60 of 377 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/node_modules/@sigstore/bundle/dist/bundle.js | package/node_modules/@sigstore/bundle/dist/bundle.js | 45 |
| high | Known Indicator Filename | package/node_modules/@sigstore/sign/dist/bundler/bundle.js | package/node_modules/@sigstore/sign/dist/bundler/bundle.js | 45 |
| high | Credential file access | package/builders/_lando.js | matched ".ssh" | 30 |
| high | Credential file access | package/hooks/app-check-ssh-keys.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/@npmcli/arborist/lib/consistent-resolve.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/@npmcli/arborist/lib/dep-valid.js | matched ".ssh" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/@npmcli/agent/lib/dns.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/retry/example/dns.js | matched "dns.resolve" | 30 |
| high | Credential file access | package/node_modules/node-forge/dist/forge.all.min.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/node-forge/dist/forge.min.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/pacote/lib/git.js | matched ".ssh" | 30 |
| high | Credential file access | package/sources/github.js | matched "id_rsa" | 30 |
| high | Credential file access | package/index.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/hosted-git-info/lib/index.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/is-lambda/index.js | matched ".AWS" | 30 |
| high | Credential file access | package/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/index.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/npm-packlist/lib/index.js | matched ".npmrc" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/socks-proxy-agent/dist/index.js | matched "dns.lookup" | 30 |
| high | Credential file access | package/components/l337-v4.js | matched ".ssh" | 30 |
| high | Credential file access | package/builders/lando-v4.js | matched ".npmrc" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/@sigstore/sign/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/npm-profile/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/npm-registry-fetch/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/sigstore/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | DNS / OAST exfiltration | package/node_modules/tuf-js/node_modules/make-fetch-happen/lib/options.js | matched "dns.lookup" | 30 |
| high | Credential file access | package/hooks/plugin-auth-from-npmrc.js | matched ".npmrc" | 30 |
| high | Credential file access | package/packages/ssh-agent/ssh-agent.js | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/node-forge/lib/ssh.js | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/is-lambda/test.js | matched ".AWS" | 30 |
| high | Credential file access | package/lib/updates.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/node_modules/object-treeify/package.json | matched ".aws" | 30 |
| high | Credential file access | package/scripts/load-keys.sh | matched ".ssh" | 30 |
| high | Credential file access | package/scripts/user-perms.sh | matched ".ssh" | 30 |
| high | Credential file access | package/node_modules/valid-path/.github/workflows/cd.yml | matched ".npmrc" | 30 |
| high | Credential file access | package/node_modules/node-gyp/gyp/.github/workflows/release-please.yml | matched "GITHUB_TOKEN" | 30 |
| medium | Obfuscation Density | package/node_modules/esprima/dist/esprima.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/node_modules/hosted-git-info/lib/hosts.js | matched "raw.githubusercontent.com" | 12 |
| medium | Remote Payload | package/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/hosts.js | matched "raw.githubusercontent.com" | 12 |
| medium | Remote Payload | package/node_modules/node-fetch/lib/index.es.js | matched "cURL " | 12 |
| medium | Obfuscation Density | package/node_modules/@isaacs/cliui/node_modules/emoji-regex/es2015/index.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/node_modules/@isaacs/cliui/node_modules/emoji-regex/index.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/node_modules/@sigstore/sign/node_modules/minipass-fetch/lib/index.js | matched "cURL " | 12 |
| medium | Obfuscation Density | package/node_modules/emoji-regex/es2015/index.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/node_modules/emoji-regex/index.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/node_modules/listr2/node_modules/emoji-regex/es2015/index.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/node_modules/listr2/node_modules/emoji-regex/index.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/node_modules/minipass-fetch/lib/index.js | matched "cURL " | 12 |
| medium | Remote Payload | package/node_modules/node-fetch/lib/index.js | matched "cURL " | 12 |
| medium | Remote Payload | package/node_modules/npm-profile/node_modules/minipass-fetch/lib/index.js | matched "cURL " | 12 |
| medium | Remote Payload | package/node_modules/npm-registry-fetch/node_modules/minipass-fetch/lib/index.js | matched "cURL " | 12 |
| medium | Remote Payload | package/node_modules/sigstore/node_modules/minipass-fetch/lib/index.js | matched "cURL " | 12 |
| medium | Obfuscation Density | package/node_modules/tr46/index.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/node_modules/tuf-js/node_modules/minipass-fetch/lib/index.js | matched "cURL " | 12 |
| medium | Remote Payload | package/node_modules/undici/lib/web/fetch/index.js | matched "curl " | 12 |
| medium | Remote Payload | package/hooks/lando-setup-buildx.js | matched "github.com/docker/buildx/releases/download" | 12 |
| medium | Remote Payload | package/hooks/lando-setup-orchestrator.js | matched "github.com/docker/compose/releases/download" | 12 |
| medium | Obfuscation Density | package/node_modules/lodash/lodash.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/node_modules/lodash/lodash.min.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/node_modules/@npmcli/arborist/node_modules/npm-package-arg/lib/npa.js | matched "cUrl\n " | 12 |
Manifest
Package metadata
Scripts13
coveragenyc report --reporter=text-lcov | coverallsdocs:buildVPL_MVB_VERSION=$(git describe --tags --always --abbrev=1 --match="v[0-9].*") vitepress build docs && npm run docs:rename-sitemapdocs:devVPL_BASE_URL=http://localhost:5173 VPL_MVB_VERSION=$(git describe --tags --always --abbrev=1 --match="v[0-9].*") vitepress dev docsdocs:mvbnpx mvb docs && npm run docs:rename-sitemapdocs:previewvitepress preview docsdocs:rename-sitemapnode docs/.vitepress/rename-sitemap.jslinteslint . --ext .js --ext .mjspkgpkg --config package.json --output dist/lando ---targets node20 --options 'dns-result-order=ipv4first' bin/landotestnpm run lint && npm run test:unittest:leialeia "examples/**/README.md" -c 'Destroy tests' --stdintest:unitnyc --reporter=html --reporter=text mocha --timeout 5000 test/**/*.spec.jstypechecktsc --project jsconfig.json 2>&1 | grep -v '^node_modules/' || truetypecheck:fulltsc --project jsconfig.json || true
Dependencies61
@lando/argv^1.2.0@npmcli/agent^2.2.2@npmcli/arborist^6.2.9@oclif/core^3.27.0@octokit/rest^19axios^1.5.1bluebird^3.4.1chalk^4.1.2clean-stacktrace^1.1.0cli-table^0.3.11cli-table3^0.6.5cli-truncate2.1.0copy-dir^0.4.0debug^4.3.4delay^5dockerfile-generator^5.0.0dockerfile-utils^0.15.0dockerode^2.4.2enquirer^2.4.1figlet^1.8.0figures^3.2.0fs-extra^11.1.1glob^7.1.3ini^5.0.0inquirer^6.5.2inquirer-autocomplete-prompt^1.4.0is-class^0.0.9is-docker^2.2.1is-interactive^1is-root^2- …and 31 more.