Package evidence

@json-editor/[email protected]

Credential File Packaged: package/.env

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 49,249Mainstream · −50% score
Versions published: 53Mature · −50% score
First published: May 2018
Publisher: germanbisurgi

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@json-editor/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@json-editor/[email protected]"],"fail_on":"high"}'

Publishergermanbisurgi

Artifact bytes1,281,972

Previous version2.15.2

Published2026-02-04T15:11:19.123Z

SHA-256b137bb5a7e51e5a8c32bfa572b6dc438e0e4e913b1174fedba56b84621f118ff

Why flagged

What the scanner saw

Credential File Packaged: package/.env

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

5h agoLast checked

highRisk

17Score

2.15.3Version

Status history (1 event)

new → available5h ago · risk high · score 17 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Credential File Packaged	package/.env	package/.env	35

Manifest

Package metadata

Scripts26

buildnpm run build.prod && npm run build.nonmin
build.devwebpack --config config/webpack.dev.js --progress --profile --bail
build.nonminwebpack --config config/webpack.nonmin.js --progress --profile --bail
build.nonmin.traviswebpack --config config/webpack.nonmin.js --env travis --progress --profile --bail
build.prodwebpack --config config/webpack.prod.js --progress --profile --bail
cleannpm run clean.css.js
clean.css.jsfind ./src -name *.css.js -type f -delete
cp:fulltestcodeceptjs run --steps
cp:fulltestmochacodeceptjs run --steps --reporter mochawesome
cp:testcodeceptjs run --steps --invert --grep @optional
cp:testmochacodeceptjs run --steps --reporter mochawesome --invert --grep @optional
debugwebpack-dev-server --config config/webpack.dev.js --progress
debug.nonminwebpack-dev-server --config config/webpack.nonmin.js --progress
docker-codeceptjsdocker-compose exec node codeceptjs run-multiple --config /repo/tests/codeceptjs/codecept.json basic:chrome --invert --grep '@optional'
docker-prepare-codeceptjsdocker-compose run --rm node npm install && docker-compose run --rm node npm run build && docker-compose up -d && docker-compose ps
docker-testnpm run docker-prepare-codeceptjs && npm run docker-codeceptjs
eslinteslint -c ./.eslintrc src/**/*.js
eslint.fixeslint -c ./.eslintrc src/**/*.js --fix
postversiongit push && git push --tags && npm publish ./ --access public
preparenpm run build
preversionnpm run test-headless && npm run docker-test
serve-testhttp-server --p 9001
testkarma start config/karma.conf.js --browsers Chrome --log-level debug
test-headlesskarma start config/karma.conf.js --singleRun true --browsers ChromeHeadless
watchwebpack --config config/webpack.nonmin.js --watch
winservercd tests && start cmd /c npm run serve-test .

Dependencies1

core-js^3.27.2