Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Publisher
- GitHub ActionsTrusted automation · −70% score
Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@openclaw/[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@openclaw/[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Credential file access: matched ".Azure"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 6453 · status changed
Related candidates
Linked campaigns and clusters
Credential file access — matched ".AZURE"
45 members · evidence strength 90Credential file access — matched ".Azure"
24 members · evidence strength 90Evidence
Static findings
312 static · 0 from release diff · showing high-signal first.
Showing 30 of 207 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/node_modules/@azure/msal-common/lib/index-browser.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.apps/node_modules/@azure/msal-common/lib/index-browser.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-common/lib/index-node.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.apps/node_modules/@azure/msal-common/lib/index-node.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-common/lib/index.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.apps/node_modules/@azure/msal-common/lib/index.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-browser/lib/msal-browser.cjs | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-browser/lib/custom-auth-path/msal-custom-auth.cjs | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-node/lib/msal-node.cjs | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.apps/node_modules/@azure/msal-node/lib/msal-node.cjs | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@azure/core-client/dist/browser/authorizeRequestOnTenantChallenge.js | matched ".azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-client/dist/commonjs/authorizeRequestOnTenantChallenge.js | matched ".azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-client/dist/esm/authorizeRequestOnTenantChallenge.js | matched ".azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-client/dist/react-native/authorizeRequestOnTenantChallenge.js | matched ".azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/azureCliCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/azureDeveloperCliCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-auth/dist/commonjs/azureKeyCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-auth/dist/commonjs/azureNamedKeyCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/azurePipelinesCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/azurePowerShellCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-auth/dist/commonjs/azureSASCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.api/dist/auth/cloud-environment.js | matched ".azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/browser/constants.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/constants.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/esm/constants.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/workerd/constants.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/defaultAzureCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/esm/credentials/defaultAzureCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/workerd/credentials/defaultAzureCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/browser/credentials/defaultAzureCredentialFunctions.js | matched ".AZURE" | 30 |
Show all 312 findings (low-signal and informational)
Showing 60 of 312 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/node_modules/@azure/msal-common/lib/index-browser.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.apps/node_modules/@azure/msal-common/lib/index-browser.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-common/lib/index-node.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.apps/node_modules/@azure/msal-common/lib/index-node.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-common/lib/index.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.apps/node_modules/@azure/msal-common/lib/index.cjs | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-browser/lib/msal-browser.cjs | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-browser/lib/custom-auth-path/msal-custom-auth.cjs | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-node/lib/msal-node.cjs | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.apps/node_modules/@azure/msal-node/lib/msal-node.cjs | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@azure/core-client/dist/browser/authorizeRequestOnTenantChallenge.js | matched ".azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-client/dist/commonjs/authorizeRequestOnTenantChallenge.js | matched ".azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-client/dist/esm/authorizeRequestOnTenantChallenge.js | matched ".azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-client/dist/react-native/authorizeRequestOnTenantChallenge.js | matched ".azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/azureCliCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/azureDeveloperCliCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-auth/dist/commonjs/azureKeyCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-auth/dist/commonjs/azureNamedKeyCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/azurePipelinesCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/azurePowerShellCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/core-auth/dist/commonjs/azureSASCredential.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.api/dist/auth/cloud-environment.js | matched ".azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/browser/constants.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/constants.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/esm/constants.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/workerd/constants.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/defaultAzureCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/esm/credentials/defaultAzureCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/workerd/credentials/defaultAzureCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/browser/credentials/defaultAzureCredentialFunctions.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/defaultAzureCredentialFunctions.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/esm/credentials/defaultAzureCredentialFunctions.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/workerd/credentials/defaultAzureCredentialFunctions.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/deviceCodeCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/esm/credentials/deviceCodeCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/workerd/credentials/deviceCodeCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/environmentCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/esm/credentials/environmentCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/workerd/credentials/environmentCredential.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/browser/client/identityClient.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/client/identityClient.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/esm/client/identityClient.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/workerd/client/identityClient.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/browser/credentials/managedIdentityCredential/imdsMsi.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/credentials/managedIdentityCredential/imdsMsi.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/esm/credentials/managedIdentityCredential/imdsMsi.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/workerd/credentials/managedIdentityCredential/imdsMsi.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-common/lib/index-node-9_Gz5QUk.js | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.apps/node_modules/@azure/msal-common/lib/index-node-Ddjhj5ij.js | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@azure/core-auth/dist/commonjs/index.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/index.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@azure/logger/dist/commonjs/index.js | matched ".Azure" | 30 |
| high | Credential file access | package/node_modules/@microsoft/teams.api/dist/auth/json-web-token.js | matched ".azure" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-browser/lib/msal-browser.js | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-browser/lib/msal-browser.min.js | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@azure/msal-browser/lib/custom-auth-path/msal-custom-auth.js | matched ".SSH" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/commonjs/util/processMultiTenantRequest.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/esm/util/processMultiTenantRequest.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/workerd/util/processMultiTenantRequest.js | matched ".AZURE" | 30 |
| high | Credential file access | package/node_modules/@azure/identity/dist/browser/regionalAuthority.js | matched ".AZURE" | 30 |
Manifest
Package metadata
Dependencies7
@azure/identity4.13.1@microsoft/teams.api2.0.11@microsoft/teams.apps2.0.11express5.2.1jsonwebtoken9.0.3jwks-rsa4.0.1typebox1.1.38