PkgRadar

Package evidence

@freesyntax/[email protected]

Credential file access: matched ".ssh"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@freesyntax/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@freesyntax/[email protected]"],"fail_on":"high"}'
Publisherdriftrailteam
Artifact bytes189,782
Previous version0.5.21
Published2026-04-21T07:22:00.340Z
SHA-256714de9e8aaef5b21ce6801cfbc1fe044b9f340f90c7688fa7375169ebdd7eb76

Why flagged

What the scanner saw

Credential file access: matched ".ssh"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
180Score
0.5.22Version
Status history (1 event)
  1. newavailable · risk high · score 180 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

driftrailteam

3 members · evidence strength 77

Evidence

Static findings

24 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential file accesspackage/dist/chunk-EPSOOCNB.jsmatched ".ssh"30
highCredential file accesspackage/dist/chunk-GBZGR6ID.jsmatched "GITHUB_TOKEN"30
highCredential file accesspackage/dist/index.jsmatched "id_rsa"30
mediumRemote Payloadpackage/dist/chunk-EPSOOCNB.jsmatched "curl "12
mediumRemote Payloadpackage/dist/chunk-W4FAGQFL.jsmatched "curl "12
mediumObfuscation Densitypackage/dist/index.jshigh encoded/escaped-token density12
Show all 24 findings (low-signal and informational)
SeverityKindPathDetailPoints
highCredential file accesspackage/dist/chunk-EPSOOCNB.jsmatched ".ssh"30
highCredential file accesspackage/dist/chunk-GBZGR6ID.jsmatched "GITHUB_TOKEN"30
highCredential file accesspackage/dist/index.jsmatched "id_rsa"30
mediumRemote Payloadpackage/dist/chunk-EPSOOCNB.jsmatched "curl "12
mediumRemote Payloadpackage/dist/chunk-W4FAGQFL.jsmatched "curl "12
mediumObfuscation Densitypackage/dist/index.jshigh encoded/escaped-token density12
lowObfuscationpackage/dist/chunk-3QUV4JEX.jsmatched "\\u2014"3
lowObfuscationpackage/dist/chunk-CQMAVWLJ.jsmatched "\\x20"3
lowObfuscationpackage/dist/chunk-EPSOOCNB.jsmatched "\\u2014"3
lowObfuscationpackage/dist/chunk-FAULT7VE.jsmatched "\\u26A0"3
lowObfuscationpackage/dist/chunk-FZVPGJJW.jsmatched "fromCharCode"3
lowObfuscationpackage/dist/chunk-GBZGR6ID.jsmatched "\\u2192"3
lowObfuscationpackage/dist/chunk-GFVLHUSS.jsmatched "\\u2014"3
lowObfuscationpackage/dist/chunk-JXQ4HZ47.jsmatched "\\xB7"3
lowObfuscationpackage/dist/chunk-KZAS754V.jsmatched "\\u2014"3
lowObfuscationpackage/dist/chunk-PKZKVOAN.jsmatched "\\u2014"3
lowObfuscationpackage/dist/chunk-TH6GKC7E.jsmatched "\\u2014"3
lowObfuscationpackage/dist/chunk-UR4XL6OM.jsmatched "\\u2014"3
lowObfuscationpackage/dist/chunk-W4FAGQFL.jsmatched "\\u26A0"3
lowObfuscationpackage/dist/config-set-3IWEVZQ4.jsmatched "\\u2014"3
lowObfuscationpackage/dist/index.jsmatched "Buffer.from(b64, \"base64"3
lowObfuscationpackage/dist/model-download-3NDKS3VM.jsmatched "\\xB7"3
lowObfuscationpackage/dist/ollama-bench-5V5CCOCQ.jsmatched "\\u2192"3
lowObfuscationpackage/dist/server-IGOZHW52.jsmatched "\\u2014"3

Manifest

Package metadata

Scripts8
  • buildtsup --dts
  • build:publishtsup
  • devtsup --watch
  • linteslint src/
  • prepublishOnlynpm run build:publish
  • startnode dist/index.js
  • testvitest run
  • typechecktsc --noEmit
Dependencies11
  • @ai-sdk/anthropic^1.2.12
  • @ai-sdk/openai^1.2.0
  • ai^4.3.2
  • chalk^5.3.0
  • commander^12.1.0
  • glob^11.0.0
  • ignore^6.0.2
  • ora^8.1.1
  • simple-git^3.27.0
  • smol-toml^1.6.1
  • zod^3.24.1