PkgRadar

Package evidence

@openhands/[email protected]

Credential file access: matched "AWS_ACCESS_KEY"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,440Niche · −30% score
Versions published
29
First published
May 2026
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: 70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@openhands/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@openhands/[email protected]"],"fail_on":"review"}'
Artifact bytes17,480,329
Previous version1.0.0-rc.10
Published2026-06-12T14:02:13.360Z
SHA-256c546090987432d6981ffe92ef27359d8a6a348e5ebc9d29502d2def42496f741

Why flagged

What the scanner saw

Credential file access: matched "AWS_ACCESS_KEY"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
21Score
1.0.0-rc.11Version
Status history (1 event)
  1. newavailable · risk review · score 21 · status changed

Evidence

Static findings

39 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 39 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/dist/i18n/declaration.cjsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/dist/node_modules/@openhands/extensions/skills/index.cjsmatched ".ssh/"5
lowCredential file accesspackage/dist/i18n/translation.cjsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/build/assets/acp-providers-Dzb4nxxB.jsmatched "GOOGLE_APPLICATION_CREDENTIALS"5
lowCredential file accesspackage/build/assets/declaration-D9ucT0fq.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/dist/i18n/declaration.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/dist/node_modules/@openhands/extensions/skills/index.jsmatched ".ssh/"5
lowCredential file accesspackage/dist/i18n/translation.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/build/assets/vendor~root-layout~home~conversation-panel~conversation~launch~skills-settings~mcp~automati~dou5smdo-DPWYsRFL.jsmatched ".ssh/"5
lowCredential file accesspackage/build/locales/ar/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/ca/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/de/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/en/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/es/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/fr/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/it/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/ja/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/ko-KR/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/no/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/pt/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/tr/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/uk/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/zh-CN/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/build/locales/zh-TW/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/ar/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/ca/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/de/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/en/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/es/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/fr/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/it/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/ja/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/ko-KR/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/no/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/pt/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/tr/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/uk/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/zh-CN/openhands.jsonmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/dist/locales/zh-TW/openhands.jsonmatched "AWS_ACCESS_KEY"3

Manifest

Package metadata

Scripts30
  • buildnpm run build:app
  • build:appnpm run make-i18n && react-router build
  • build:dockernode scripts/docker-build.mjs
  • build:libnpm run make-i18n && react-router typegen && cross-env BUILD_LIB=true VITE_APP_ENV=production vite build && tsc -p tsconfig.lib.json
  • build:mocknpm run make-i18n && cross-env VITE_MOCK_API=true react-router build
  • check-translation-completenessnode scripts/check-translation-completeness.cjs
  • devnode --env-file-if-exists=.env scripts/dev-with-automation.mjs
  • dev:extra-backendnode --env-file-if-exists=.env scripts/dev-extra-backend.mjs
  • dev:frontendnpm run make-i18n && cross-env VITE_MOCK_API=false react-router dev
  • dev:minimalnode --env-file-if-exists=.env scripts/dev-safe.mjs
  • dev:mocknpm run make-i18n && cross-env VITE_MOCK_API=true react-router dev
  • dev:staticnode --env-file-if-exists=.env scripts/dev-static.mjs
  • dev_wslVITE_WATCH_USE_POLLING=true vite
  • lintnpm run typecheck && eslint src && prettier --check src/**/*.{ts,tsx}
  • lint:fixeslint src --fix && prettier --write src/**/*.{ts,tsx}
  • make-i18nnode scripts/make-i18n-translations.cjs
  • prelintnpm run make-i18n
  • preparehusky
  • previewvite preview
  • startnpx sirv-cli build/ --single
  • testnpm run make-i18n && vitest run
  • test:coveragenpm run make-i18n && vitest run --coverage
  • test:e2eplaywright test --pass-with-no-tests
  • test:e2e:livenode --env-file-if-exists=.env tests/e2e/live/scripts/run-live-e2e.mjs
  • test:e2e:mock-llmplaywright test --config=playwright.mock-llm.config.ts
  • test:e2e:mock-llm:dockerplaywright test --config=playwright.mock-llm-docker.config.ts
  • test:e2e:snapshotsplaywright test tests/e2e/snapshots --project=chromium --retries=0
  • test:e2e:snapshots:updateplaywright test tests/e2e/snapshots --project=chromium --update-snapshots
  • typecheckreact-router typegen && tsc
  • typecheck:stagedreact-router typegen && npx tsc --noEmit --skipLibCheck
Dependencies48
  • @heroui/react2.8.10
  • @microlink/react-json-view1.31.20
  • @monaco-editor/react4.7.0
  • @openhands/extensions0.4.2
  • @openhands/typescript-client1.24.3
  • @react-router/node7.17.0
  • @react-router/serve7.17.0
  • @tailwindcss/vite4.2.4
  • @tanstack/react-query5.100.9
  • @types/shell-quote^1.7.5
  • @uidotdev/usehooks2.4.1
  • @xterm/addon-fit0.11.0
  • @xterm/xterm6.0.0
  • axios1.16.0
  • class-variance-authority0.7.1
  • clsx2.1.1
  • downshift9.3.2
  • framer-motion12.38.0
  • i18next26.0.8
  • i18next-browser-languagedetector8.2.1
  • i18next-http-backend4.0.0
  • isbot5.1.39
  • lucide-react1.14.0
  • monaco-editor0.55.1
  • posthog-js1.372.6
  • react19.2.5
  • react-dom19.2.5
  • react-hot-toast2.6.0
  • react-i18next17.0.6
  • react-icons5.6.0
  • …and 18 more.