Package evidence
@mseep/[email protected]
Js Hidden Powershell, Remote Payload, Credential file access
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Versions published
- 1
- First published
- Jun 2026
- Publisher
- skydeckai
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@mseep/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@mseep/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Js Hidden Powershell
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 99 · status changed
Evidence
Static findings
11 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Js Hidden Powershell | package/src/tools/PowerShellTool/pathValidation.ts | — | 45 |
| high | Js Hidden Powershell | package/src/utils/permissions/permissions.ts | — | 45 |
| high | Js Hidden Powershell | package/src/utils/permissions/yoloClassifier.ts | — | 45 |
| medium | Remote Payload | package/start-ollama.sh | — | 12 |
| medium | Remote Payload | package/src/utils/plugins/installCounts.ts | — | 12 |
| medium | Remote Payload | package/src/utils/releaseNotes.ts | — | 12 |
Show all 11 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Js Hidden Powershell | package/src/tools/PowerShellTool/pathValidation.ts | — | 45 |
| high | Js Hidden Powershell | package/src/utils/permissions/permissions.ts | — | 45 |
| high | Js Hidden Powershell | package/src/utils/permissions/yoloClassifier.ts | — | 45 |
| medium | Remote Payload | package/start-ollama.sh | — | 12 |
| medium | Remote Payload | package/src/utils/plugins/installCounts.ts | — | 12 |
| medium | Remote Payload | package/src/utils/releaseNotes.ts | — | 12 |
| low | Credential file access | package/src/services/api/client.ts | — | 5 |
| low | Credential file access | package/src/utils/ide.ts | — | 5 |
| low | Credential file access | package/src/tools/BashTool/prompt.ts | — | 5 |
| low | Credential file access | package/src/utils/subprocessEnv.ts | — | 5 |
| low | Credential file access | package/src/utils/settings/types.ts | — | 5 |
Manifest
Package metadata
Scripts 3
Sign in to view install / lifecycle script contents.
Dependencies88
@alcalzone/ansi-tokenize^0.3.0@anthropic-ai/bedrock-sdk^0.26.4@anthropic-ai/claude-agent-sdklatest@anthropic-ai/foundry-sdk^0.2.3@anthropic-ai/sdklatest@aws-sdk/client-bedrocklatest@aws-sdk/client-bedrock-runtimelatest@aws-sdk/client-stslatest@aws-sdk/credential-provider-nodelatest@aws-sdk/credential-providerslatest@azure/identitylatest@commander-js/extra-typings12@growthbook/growthbooklatest@modelcontextprotocol/sdklatest@opentelemetry/apilatest@opentelemetry/api-logslatest@opentelemetry/corelatest@opentelemetry/exporter-logs-otlp-grpclatest@opentelemetry/exporter-logs-otlp-httplatest@opentelemetry/exporter-logs-otlp-protolatest@opentelemetry/exporter-metrics-otlp-grpclatest@opentelemetry/exporter-metrics-otlp-httplatest@opentelemetry/exporter-metrics-otlp-protolatest@opentelemetry/exporter-prometheuslatest@opentelemetry/exporter-trace-otlp-grpclatest@opentelemetry/exporter-trace-otlp-httplatest@opentelemetry/exporter-trace-otlp-protolatest@opentelemetry/resourceslatest@opentelemetry/sdk-logslatest@opentelemetry/sdk-metricslatest- …and 58 more.