Package evidence

@gadmin2n/[email protected]

Credential File Packaged: package/dist/lib/application/files/gadmin2-game-angle-demo/server/.env

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,134Niche · −30% score
Versions published: 42
First published: Feb 2026
Publisher: mage611

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@gadmin2n/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@gadmin2n/[email protected]"],"fail_on":"high"}'

Publishermage611

Artifact bytes1,176,073

Previous version0.0.96

Published2026-06-11T08:52:46.161Z

SHA-256ca2db694726e14d9a74a1c8d4eda5d83c7467bfd8e326d926235580d22cae374

Why flagged

What the scanner saw

Credential File Packaged: package/dist/lib/application/files/gadmin2-game-angle-demo/server/.env

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

2d agoLast checked

highRisk

70Score

0.0.97Version

Status history (1 event)

new → available2d ago · risk high · score 70 · status changed

Evidence

Static findings

6 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Credential File Packaged	package/dist/lib/application/files/gadmin2-game-angle-demo/server/.env	package/dist/lib/application/files/gadmin2-game-angle-demo/server/.env	35
high	Credential File Packaged	package/dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.env	package/dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.env	35
high	Credential File Packaged	package/dist/lib/application/files/gadmin2-game-angle-demo/web/.env	package/dist/lib/application/files/gadmin2-game-angle-demo/web/.env	35

Show all 6 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Credential File Packaged	package/dist/lib/application/files/gadmin2-game-angle-demo/server/.env	package/dist/lib/application/files/gadmin2-game-angle-demo/server/.env	35
high	Credential File Packaged	package/dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.env	package/dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/.env	35
high	Credential File Packaged	package/dist/lib/application/files/gadmin2-game-angle-demo/web/.env	package/dist/lib/application/files/gadmin2-game-angle-demo/web/.env	35
low	Obfuscation Density	package/dist/lib/application/files/gadmin2-game-angle-demo/server/package-lock.json	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/lib/application/files/gadmin2-game-angle-demo/temporal/worker/package-lock.json	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/lib/application/files/gadmin2-game-angle-demo/web/package-lock.json	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts16

buildrm -rf dist && tsc --project tsconfig.lib.json
cleangulp clean:src
copy:collectioncpx src/collection.json dist && cpx 'src/lib/**/schema.json' dist/lib
copy:libcpx 'src/lib/**/{files,workspace}/**/*' dist/lib && cpx 'src/lib/**/{files,workspace}/**/.!(gitignore|env.local|env.*.local)' dist/lib
linteslint '{src,test}/**/*.ts' --fix
postbuildnpm run copy:collection && npm run copy:lib && npm run scrub:dist
prepublish:nextnpm run build
prepublish:npmnpm run build
prepublishOnlynpm run scrub:dist
prereleasenpm run build
publish:nextnpm publish --access public --tag next
publish:npmnpm publish --access public
releaserelease-it
scrub:distfind dist $ -name '.env.local' -o -name '.env.*.local' $ -type f -print -delete 2>/dev/null; true
testnpm run clean && NODE_ENV=test jest -w 1 --no-cache --config jest.json
test:devNODE_ENV=test npm run -s test -- --watchAll

Dependencies6

@angular-devkit/core13.3.2
@angular-devkit/schematics13.3.2
fs-extra10.0.1
jsonc-parser3.0.0
pluralize8.0.0
ts-morph^14.0.0