Package evidence

@local-labs-jpollock/[email protected]

Credential file access: matched ".ssh"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 67
Versions published: 25
First published: Mar 2026
Publisher: jpollock911

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@local-labs-jpollock/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@local-labs-jpollock/[email protected]"],"fail_on":"review"}'

Publisherjpollock911

Artifact bytes18,562,937

Previous version0.3.1

Published2026-05-15T18:53:12.400Z

SHA-2563861e7e076b54a9c46871c976507c1c4839425a06552c689c3e613215fadf068

Why flagged

What the scanner saw

Credential file access: matched ".ssh"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

16d agoLast checked

reviewRisk

30Score

0.3.2Version

Status history (1 event)

new → available16d ago · risk review · score 30 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Credential file access	package/lib/cli/commands/troubleshoot.js	matched ".ssh"	10

Show all 5 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Credential file access	package/lib/cli/commands/troubleshoot.js	matched ".ssh"	10
low	Credential file access	package/lib/main/mcp/modules/wpe/create-ssh-key.js	matched ".ssh"	5
low	Credential file access	package/lib/main/mcp/local-services-bridge.js	matched ".ssh"	5
low	Credential file access	package/lib/main/graphql/resolvers.js	matched ".ssh"	5
low	Credential file access	package/lib/main/graphql/resolvers/wp-cli.js	matched ".ssh"	5

Manifest

Package metadata

Scripts42

buildnpm run clean && npm run compile && npm run create-entry-points && npm run download-model
cleanrm -rf lib
compiletsc -p .
create-entry-pointsnode scripts/create-entry-points.js
download-modelnode scripts/download-model.js
eval:runnpx promptfoo eval -c tests/evals/promptfoo/promptfooconfig.yaml --no-cache --max-concurrency 1
eval:scorenode tests/evals/viewer/server.js
eval:viewnpx promptfoo view
linteslint src --ext .ts,.tsx
packagenode scripts/package-addon.js
package:linux-x64node scripts/package-addon.js --platform linux --arch x64
package:mac-armnode scripts/package-addon.js --platform darwin --arch arm64
package:mac-x64node scripts/package-addon.js --platform darwin --arch x64
package:win-x64node scripts/package-addon.js --platform win32 --arch x64
pretestnode -e "try{require('better-sqlite3');}catch(e){process.exit(1)}" || npm rebuild better-sqlite3 --silent
pretest:cli-e2eecho 'Requires PRODUCTION Local running (/Applications/Local.app)'
pretest:e2eecho 'Requires Local running with Nexus AI addon loaded'
pretest:integrationnpm run download-model
pretest:stressecho 'Requires Local running with Nexus AI addon loaded'
rebuildelectron-rebuild -v 37.8.0 -f -w better-sqlite3
stripbash scripts/strip-platforms.sh
sync-wp-pluginsnode scripts/create-entry-points.js
testjest
test:allnpm test && npm run test:eval && npm run test:integration && npm run test:e2e
test:cli-e2ejest --config tests/e2e-cli/jest.cli-e2e.config.js
test:cli-e2e:verbosejest --config tests/e2e-cli/jest.cli-e2e.config.js --verbose
test:coveragejest --coverage
test:e2ejest --config tests/e2e/jest.e2e.config.js
test:e2e:browserplaywright test --config tests/e2e/playwright.config.ts
test:e2e:browser:debugplaywright test --config tests/e2e/playwright.config.ts --debug
…and 12 more.

Dependencies14

@lancedb/lancedb^0.13.0
apache-arrow>=13.0.0 <=17.0.0
better-sqlite3^11.10.0
commander^11.1.0
graphql^16.13.2
graphql-tag^2.12.6
lodash^4.17.21
mysql2^3.11.0
onnxruntime-node^1.20.0
p-limit^7.3.0
p-queue^6.6.2
react-window^1.8.10
tar^6.2.1
zod^3.22.4