Package evidence

@maxacad/[email protected]

Credential file access: matched ".npmrc"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 1
First published: Jun 2026
Publisher: maxacad

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@maxacad/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@maxacad/[email protected]"],"fail_on":"review"}'

Publishermaxacad

Artifact bytes364,777

Previous versionnone

Published2026-06-13T12:56:01.356Z

SHA-2568c91c05e855082761f0b7e070a34038a0146f2d49c66304e5b3f198f4c4d3851

Why flagged

What the scanner saw

Credential file access: matched ".npmrc"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

12h agoLast checked

reviewRisk

25Score

1.0.0Version

Status history (1 event)

new → available12h ago · risk review · score 25 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Credential file access	package/bin/index.js	matched ".npmrc"	10
medium	Suspicious Publish Context	manifest	{"package_age_days":0,"publisher":"maxacad","burst_same_day":0,"burst_week":0,"lure":{"kind":"edit_distance","target":"ini"},"version_anomaly":false,"new_account":false}	10

Show all 5 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Credential file access	package/bin/index.js	matched ".npmrc"	10
medium	Suspicious Publish Context	manifest	{"package_age_days":0,"publisher":"maxacad","burst_same_day":0,"burst_week":0,"lure":{"kind":"edit_distance","target":"ini"},"version_anomaly":false,"new_account":false}	10
low	Credential file access	package/dist/cli.js	matched ".npmrc"	5
low	Obfuscation Density	package/pnpm-lock.yaml	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cli.js	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts18

androidreact-native run-android
bundle:allnpm run bundle:android && npm run bundle:ios
bundle:androidPLATFORM=android react-native bundle --platform android --dev false --entry-file index.js --bundle-output build/generated/android/index.android.bundle --assets-dest build/generated/android/assets && ./scripts/cleanup-outputs.sh
bundle:iosPLATFORM=ios react-native bundle --platform ios --dev false --entry-file index.js --bundle-output build/generated/ios/main.jsbundle --assets-dest build/generated/ios/assets && ./scripts/cleanup-outputs.sh
bundle:ios2PLATFORM=ios react-native bundle --platform ios --dev false --entry-file index.js --bundle-output build/generated/ios/main.jsbundle --assets-dest build/generated/ios/assets && ./scripts/cleanup-outputs.sh
deploynpm run bundle:all && npm run upload:azure
formatprettier --write "src/**/*.{ts,tsx,js,jsx,json}"
format:checkprettier --check "src/**/*.{ts,tsx,js,jsx,json}"
iosreact-native run-ios
linteslint .
localreact-native start --reset-cache --port 8088
local2PLATFORM=ios react-native start --platform ios --dev false --reset-cache --port 8088
startreact-native start --platform ios --reset-cache
start:minified:androidMINIFY=true PLATFORM=android react-native start --platform android --reset-cache --port 8088
start:minified:iosMINIFY=true PLATFORM=ios react-native start --platform ios --reset-cache --port 8088
start:prod react-native start --platform ios --reset-cache --port 8088
testjest
upload:azureENVFILE=.env ./scripts/upload-to-azure.sh

Dependencies33

@gorhom/bottom-sheet^5.2.14
@maxacad/core-utils^1.0.17
@maxacad/remote-log-manager^1.0.5
@maxacad/ui-kit^1.0.36
@react-native-async-storage/async-storage2.0.0
@react-native-community/datetimepicker^8.5.0
@react-native-community/netinfo11.4.1
@react-native-picker/picker2.11.1
@react-navigation/native^7.1.19
@react-navigation/native-stack^7.6.2
@reduxjs/toolkit^2.4.0
axios^1.9.0
base64-js^1.5.1
cross-env^10.0.0
i18next^25.3.1
moment^2.30.1
moment-timezone^0.5.48
react19.1.0
react-i18next^15.6.0
react-native0.81.4
react-native-fs^2.20.0
react-native-gesture-handler~2.28.0
react-native-image-picker^8.2.1
react-native-netinfo^1.1.0
react-native-reanimated~4.1.1
react-native-svg^15.12.1
react-native-vector-icons^10.3.0
react-native-webview^13.16.1
react-native-worklets0.5.1
react-redux^9.1.2
…and 3 more.