PkgRadar

Package evidence

@kintone/[email protected]

Credential file access: matched "GITHUB_TOKEN"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
4,786Niche · −30% score
Versions published
19Established · −30% score
First published
Oct 2024
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: 70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@kintone/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@kintone/[email protected]"],"fail_on":"review"}'
Artifact bytes126,677
Previous version1.19.1
Published2026-03-31T07:47:43.886Z
SHA-256e33e7d0b9d569bcc5cb0fe750dab7875d1da429aaba927d0911f5a59d843308e

Why flagged

What the scanner saw

Credential file access: matched "GITHUB_TOKEN"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
1Score
1.19.2Version
Status history (1 event)
  1. newavailable · risk review · score 1 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/lib/src/utils/github.jsmatched "GITHUB_TOKEN"5

Manifest

Package metadata

Scripts34
  • buildrun-s clean:lib build:tsc
  • build:allrun-s build build:artifacts
  • build:artifactsrun-s clean:artifacts build:executables license:analyze license:extract compress
  • build:executablesrun-s build:ncc package
  • build:nccncc build ./src/cli/main.ts -m
  • build:tsctsc --build ./tsconfig.build.json
  • cleanrun-s clean:lib clean:artifacts clean:test
  • clean:artifactsrimraf bin artifacts dist
  • clean:librimraf lib
  • clean:testrimraf allure-results allure-report
  • compresszx ./scripts/compress-to-zip-file.ts
  • doc:buildpnpm --filter ./website build
  • doc:servepnpm --filter ./website serve
  • doc:startpnpm --filter ./website start
  • doc:start:japnpm --filter ./website start:ja
  • doc:update-creditspnpm --filter ./website update-credits
  • fixrun-p fix:*
  • fix:lintrun-s 'lint:eslint --fix'
  • fix:prettierrun-s 'lint:prettier --write'
  • license:analyzelicense-manager analyze -c license-manager.config.js
  • license:extractlicense-manager extract -c license-manager.config.js -w .
  • lintrun-p -l lint:*
  • lint:eslinteslint ./ --max-warnings 0 --cache --cache-location ./node_modules/.cache/eslint/
  • lint:prettierprettier --check '**/*.{json,md,yml,yaml}' --cache
  • packagemkdirp ./bin && pkg --sea ./dist/index.js -o ./bin/cli-kintone -t linux-x64,macos-arm64,win-x64
  • startrun-s clean:lib 'build:tsc --watch'
  • testvitest run
  • test:cipnpm clean:test && vitest run --config vitest.config.ci.ts
  • test:e2ecucumber-js
  • test:e2e:cipnpm clean:test && cucumber-js --format ./cucumber-reporter.js:./allure-results/dummy.txt
  • …and 4 more.
Dependencies14
  • @inquirer/prompts^7.10.1
  • @kintone/plugin-manifest-validator^11.1.0
  • @kintone/rest-api-client6.1.4
  • chalk4.1.2
  • chokidar^4.0.3
  • csv-parse^5.6.0
  • csv-stringify6.5.2
  • https-proxy-agent^7.0.6
  • iconv-lite^0.7.2
  • node-rsa^1.1.1
  • tar^7.5.13
  • yargs^17.7.2
  • yauzl^3.2.1
  • yazl^3.3.1