PkgRadar

Package evidence

@grolm/[email protected]

Credential file access: matched "GITHUB_TOKEN"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@grolm/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@grolm/[email protected]"],"fail_on":"high"}'
Publishergrolm
Artifact bytes268,475
Previous version3.0.3
Published2026-05-25T03:14:41.894Z
SHA-256cbf998a8419ee45b225657fad47682dc7000b222241b1d10db51115a0ce1f9e0

Why flagged

What the scanner saw

Credential file access: matched "GITHUB_TOKEN"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
33Score
3.1.1Version
Status history (1 event)
  1. new → available · risk high · score 33 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

grolm

2 members · evidence strength 50

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential file accesspackage/.github/workflows/publish.ymlmatched "GITHUB_TOKEN"30
Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
highCredential file accesspackage/.github/workflows/publish.ymlmatched "GITHUB_TOKEN"30
lowObfuscationpackage/cli/index.jsmatched "\\x1b"3

Manifest

Package metadata

Scripts6
  • buildtsup src/index.ts --config tsup.config.ts
  • build:typescp rustplus.proto proto.proto && protoc --ts_out=./src --ts_opt long_type_string --proto_path . proto.proto && npm run build:types:clean || npm run build:types:clean
  • build:types:cleanrm proto.proto
  • formatprettier --write .
  • linttsc --noEmit
  • releasenpm run build && changeset publish
Dependencies16
  • @protobuf-ts/plugin^2.9.3
  • axios^1.2.2
  • chrome-launcher^0.15.0
  • command-line-args^5.2.0
  • command-line-usage^6.1.1
  • express^4.17.1
  • jimp^0.22.12
  • long^5.2.1
  • protobufjs^7.2.1
  • protoc^1.1.3
  • push-receiver^2.1.0
  • ts-proto^1.148.1
  • type-fest^3.7.2
  • typed-emitter^2.1.0
  • uuid^9.0.0
  • ws^8.3.0