Package evidence
@geminilight/[email protected]
Native Addon Gyp Action: binding.gyp runs a script or chains shell during node-gyp build (executes outside package.json lifecycle)
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 26
- Versions published
- 9
- First published
- May 2026
- Publisher
- geminilight
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@geminilight/[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@geminilight/[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Native Addon Gyp Action: binding.gyp runs a script or chains shell during node-gyp build (executes outside package.json lifecycle)
1 candidate cluster(s) currently reference this release.
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 147 · status changed
Related candidates
Linked campaigns and clusters
Native Addon Gyp Action — binding.gyp runs a script or chains shell during node-gyp build (executes outside package.json lifecycle)
44 members · evidence strength 90Native Addon Gyp Action — binding.gyp runs a script or chains shell during node-gyp build (executes outside package.json lifecycle)
44 members · max score 147Evidence
Static findings
36 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Native Addon Gyp Action | package/_standalone/__node_modules/sharp/src/binding.gyp | binding.gyp runs a script or chains shell during node-gyp build (executes outside package.json lifecycle) | 35 |
| medium | Remote Payload | package/_standalone/__node_modules/next/dist/lib/mkcert.js | matched "github.com/FiloSottile/mkcert/releases/download" | 12 |
Show all 36 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Native Addon Gyp Action | package/_standalone/__node_modules/sharp/src/binding.gyp | binding.gyp runs a script or chains shell during node-gyp build (executes outside package.json lifecycle) | 35 |
| medium | Remote Payload | package/_standalone/__node_modules/next/dist/lib/mkcert.js | matched "github.com/FiloSottile/mkcert/releases/download" | 12 |
| low | Credential file access | package/_standalone/__next/server/chunks/6602.js | matched ".ssh/" | 5 |
| low | Credential file access | package/_standalone/__next/static/chunks/7156-9bff361e032a7906.js | matched "GOOGLE_APPLICATION_CREDENTIALS" | 5 |
| low | Credential file access | package/static-web/_next/static/chunks/7156-9bff361e032a7906.js | matched "GOOGLE_APPLICATION_CREDENTIALS" | 5 |
| low | Credential file access | package/_standalone/__next/static/chunks/9440-eee639175695be7d.js | matched ".ssh/" | 5 |
| low | Credential file access | package/static-web/_next/static/chunks/9440-eee639175695be7d.js | matched ".ssh/" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@mariozechner/pi-coding-agent/dist/cli/args.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/_standalone/__node_modules/google-auth-library/build/src/auth/defaultawssecuritycredentialssupplier.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@aws-sdk/client-bedrock-runtime/dist-es/models/enums.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@mariozechner/pi-agent-core/node_modules/@mariozechner/pi-ai/dist/env-api-keys.js | matched "GOOGLE_APPLICATION_CREDENTIALS" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@mariozechner/pi-ai/dist/env-api-keys.js | matched "GOOGLE_APPLICATION_CREDENTIALS" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@mariozechner/pi-coding-agent/node_modules/@mariozechner/pi-ai/dist/env-api-keys.js | matched "GOOGLE_APPLICATION_CREDENTIALS" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/_standalone/__node_modules/google-auth-library/build/src/auth/googleauth.js | matched "GOOGLE_APPLICATION_CREDENTIALS" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@aws-sdk/client-bedrock-runtime/dist-cjs/index.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@aws-sdk/credential-provider-env/dist-cjs/index.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@aws-sdk/credential-provider-ini/dist-cjs/index.js | matched "aws_access_key" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@aws-sdk/credential-provider-node/dist-cjs/index.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveStaticCredentials.js | matched "aws_access_key" | 5 |
| low | Credential file access | package/bin/lib/sync.js | matched "id_rsa" | 5 |
| low | Credential file access | package/_standalone/__node_modules/@aws-sdk/credential-provider-ini/package.json | matched ".aws/" | 3 |
| low | Credential file access | package/_standalone/__node_modules/@aws-sdk/credential-provider-process/package.json | matched ".aws/" | 3 |
| low | Obfuscation Density | package/dist/protocols/mcp-server/index.cjs | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/_standalone/__next/server/chunks/1976.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/_standalone/__next/server/chunks/4998.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/_standalone/__next/server/chunks/8461.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/_standalone/__next/server/chunks/9969.js | high encoded/escaped-token density | 0 |
| low | Large Javascript Payload | package/_standalone/__node_modules/jsdom/lib/generated/idl/CSSStyleProperties.js | 2348074 bytes | 0 |
| low | Obfuscation Density | package/_standalone/__node_modules/esprima/dist/esprima.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/_standalone/__node_modules/lodash.snakecase/index.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/_standalone/__node_modules/styled-jsx/dist/webpack/index.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/protocols/acp/index.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/_standalone/__node_modules/next/dist/next-devtools/server/launch-editor.js | high encoded/escaped-token density | 0 |
| low | Large Javascript Payload | package/_standalone/__node_modules/pdfjs-dist/legacy/build/pdf.worker.mjs | 2346450 bytes | 0 |