PkgRadar

Package evidence

@guilhermefsousa/[email protected]

Credential file access: matched "GITHUB_TOKEN"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@guilhermefsousa/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@guilhermefsousa/[email protected]"],"fail_on":"high"}'
Publisherguilhermefsousa
Artifact bytes496,550
Previous version1.2.25
Published2026-05-19T17:57:32.200Z
SHA-256fe7be05ea58937b083aa8febda4ae8694a0f38f2831f96e895887c0bb12f7e7c

Why flagged

What the scanner saw

Credential file access: matched "GITHUB_TOKEN"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
183Score
1.2.26Version
Status history (1 event)
  1. new → available · risk high · score 183 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

guilhermefsousa

2 members · evidence strength 64

Evidence

Static findings

10 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential file accesspackage/templates/agents/templates/ci-dotnet.ymlmatched "GITHUB_TOKEN"30
highCredential file accesspackage/templates/agents/templates/ci-java.ymlmatched "GITHUB_TOKEN"30
highCredential file accesspackage/templates/agents/templates/ci-node.ymlmatched "GITHUB_TOKEN"30
highCredential file accesspackage/templates/agents/templates/ci-python.ymlmatched "GITHUB_TOKEN"30
mediumRemote Payloadpackage/src/utils/mcp-detect.jsmatched "curl "12
mediumRemote Payloadpackage/templates/telemetry/scripts/emit-synthetic.mjsmatched "curl "12
mediumRemote Payloadpackage/templates/agents/skills/integrating-apis/scripts/fill_form.pymatched "curl "12
mediumRemote Payloadpackage/templates/telemetry/tests/redaction.test.shmatched "curl "12
mediumRemote Payloadpackage/templates/telemetry/scripts/validate-rules.shmatched "curl "12
Show all 10 findings (low-signal and informational)
SeverityKindPathDetailPoints
highCredential file accesspackage/templates/agents/templates/ci-dotnet.ymlmatched "GITHUB_TOKEN"30
highCredential file accesspackage/templates/agents/templates/ci-java.ymlmatched "GITHUB_TOKEN"30
highCredential file accesspackage/templates/agents/templates/ci-node.ymlmatched "GITHUB_TOKEN"30
highCredential file accesspackage/templates/agents/templates/ci-python.ymlmatched "GITHUB_TOKEN"30
mediumRemote Payloadpackage/src/utils/mcp-detect.jsmatched "curl "12
mediumRemote Payloadpackage/templates/telemetry/scripts/emit-synthetic.mjsmatched "curl "12
mediumRemote Payloadpackage/templates/agents/skills/integrating-apis/scripts/fill_form.pymatched "curl "12
mediumRemote Payloadpackage/templates/telemetry/tests/redaction.test.shmatched "curl "12
mediumRemote Payloadpackage/templates/telemetry/scripts/validate-rules.shmatched "curl "12
lowObfuscationpackage/src/parsers/markdown-sections.jsmatched "\\u0300"3

Manifest

Package metadata

Scripts2
  • emit-syntheticnode emit-synthetic.mjs
  • validatebash validate-rules.sh
Dependencies7
  • @opentelemetry/api^1.9.0
  • @opentelemetry/exporter-metrics-otlp-http^0.56.0
  • @opentelemetry/exporter-trace-otlp-http^0.56.0
  • @opentelemetry/resources^1.30.0
  • @opentelemetry/sdk-metrics^1.30.0
  • @opentelemetry/sdk-trace-node^1.30.0
  • @opentelemetry/semantic-conventions^1.28.0