Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@noalia/[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@noalia/[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Credential file access: matched "AWS_ACCESS_KEY"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 345 · status changed
Related candidates
Linked campaigns and clusters
noalia.dev
6 members · evidence strength 81Evidence
Static findings
34 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/lib/auto-refactoring-engine.js | matched "AWS_ACCESS_KEY" | 30 |
| high | Credential file access | package/lib/benchmark-runner.js | matched "AWS_ACCESS_KEY" | 30 |
| high | Credential file access | package/lib/domain-analyzers.js | matched "AWS_ACCESS_KEY" | 30 |
| high | Credential file access | package/lib/github-integration.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/lib/iac-scanner.js | matched "aws_access_key" | 30 |
| high | Credential file access | package/lib/security-rules-extended.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/lib/tool-bridge.js | matched "GITHUB_TOKEN" | 30 |
| medium | Remote Payload | package/lib/container-scanner.js | matched "curl " | 12 |
| medium | Remote Payload | package/lib/sarif-exporter.js | matched "raw.githubusercontent.com" | 12 |
| medium | Remote Payload | package/lib/security-rules-extended.js | matched "curl " | 12 |
| medium | Remote Payload | package/lib/rules/security-rules-infrastructure.js | matched "curl " | 12 |
| medium | Remote Payload | package/lib/godmode/titan-report.js | matched "raw.githubusercontent.com" | 12 |
| medium | Remote Payload | package/lib/visual-report-generator.js | matched "raw.githubusercontent.com" | 12 |
Show all 34 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/lib/auto-refactoring-engine.js | matched "AWS_ACCESS_KEY" | 30 |
| high | Credential file access | package/lib/benchmark-runner.js | matched "AWS_ACCESS_KEY" | 30 |
| high | Credential file access | package/lib/domain-analyzers.js | matched "AWS_ACCESS_KEY" | 30 |
| high | Credential file access | package/lib/github-integration.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/lib/iac-scanner.js | matched "aws_access_key" | 30 |
| high | Credential file access | package/lib/security-rules-extended.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/lib/tool-bridge.js | matched "GITHUB_TOKEN" | 30 |
| medium | Remote Payload | package/lib/container-scanner.js | matched "curl " | 12 |
| medium | Remote Payload | package/lib/sarif-exporter.js | matched "raw.githubusercontent.com" | 12 |
| medium | Remote Payload | package/lib/security-rules-extended.js | matched "curl " | 12 |
| medium | Remote Payload | package/lib/rules/security-rules-infrastructure.js | matched "curl " | 12 |
| medium | Remote Payload | package/lib/godmode/titan-report.js | matched "raw.githubusercontent.com" | 12 |
| medium | Remote Payload | package/lib/visual-report-generator.js | matched "raw.githubusercontent.com" | 12 |
| low | Obfuscation | package/lib/ai-attribution.js | matched "\\x1e" | 3 |
| low | Obfuscation | package/lib/ast-analyzer.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/audit-logging.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/lib/custom-rules-engine.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/domain-analyzers.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/enhanced-analyzer.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/fix-ensemble.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/rules/framework-security-rules.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/hierarchical-orchestrator.js | matched "\\x00" | 3 |
| low | Obfuscation | package/lib/php-security-analyzer.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/agent-runtime/planner.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/python-analyzer.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/security-rules-extended.js | matched "Buffer.from(body, 'base64" | 3 |
| low | Obfuscation | package/lib/rules/security-rules-java.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/rules/security-rules-python.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/rules/security-rules-react-node.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/security-rules.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/sso-auth.js | matched "Buffer.from(samlResponse, \"base64" | 3 |
| low | Obfuscation | package/lib/supply-chain-analyzer.js | matched "\\u202A" | 3 |
| low | Obfuscation | package/lib/taint-analyzer.js | matched "eval(" | 3 |
| low | Obfuscation | package/lib/godmode/titan-detect.js | matched "eval(" | 3 |
Manifest
Package metadata
Scripts3
testjesttest:coveragejest --coveragetest:watchjest --watch
Dependencies5
@babel/parser^7.28.5@babel/traverse^7.28.5@supabase/supabase-js^2.39.0dotenv^16.3.1simple-git^3.35.3