Package evidence

@openstreetmap/[email protected]

Credential File Packaged: package/.env

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,943Niche · −30% score
Versions published: 11Established · −30% score
First published: Nov 2025
Publisher: tyr_asd

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@openstreetmap/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@openstreetmap/[email protected]"],"fail_on":"high"}'

Publishertyr_asd

Artifact bytes19,944,868

Previous version2.39.4

Published2026-03-23T16:48:59.279Z

SHA-256e64901eab2626eb68093181d8792186eb2182944ebadb8b4e6e39e0afc5b5334

Why flagged

What the scanner saw

Credential File Packaged: package/.env

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

6h agoLast checked

highRisk

35Score

2.39.5Version

Status history (1 event)

new → available6h ago · risk high · score 35 · status changed

Evidence

Static findings

7 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Credential File Packaged	package/.env	package/.env	35
medium	Remote Dependency Spec	package.json	devDependencies.@actions/github-script="github:actions/github-script#v8.0.0"	8
medium	Remote Dependency Spec	package.json	devDependencies.editor-layer-index="github:osmlab/editor-layer-index#gh-pages"	8

Show all 7 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Credential File Packaged	package/.env	package/.env	35
medium	Remote Dependency Spec	package.json	devDependencies.@actions/github-script="github:actions/github-script#v8.0.0"	8
medium	Remote Dependency Spec	package.json	devDependencies.editor-layer-index="github:osmlab/editor-layer-index#gh-pages"	8
low	Large Javascript Payload	package/dist/iD.js	4384467 bytes	0
low	Large Javascript Payload	package/dist/iD.min.js	2137141 bytes	0
low	Large Javascript Payload	package/dist/mapillary-js/mapillary.module.js	2527049 bytes	0
low	Large Javascript Payload	package/dist/mapillary-js/mapillary.unminified.js	2795506 bytes	0

Manifest

Package metadata

Scripts32

allrun-s clean build dist
buildrun-s build:css build:data build:js
build:cssnode scripts/build_css.js
build:datashx mkdir -p dist/data && node scripts/build_data.js
build:jsnode config/esbuild.config.js
build:js:watchnode config/esbuild.config.js --watch
build:statsnode config/esbuild.config.min.js --stats && esbuild-visualizer --metadata dist/esbuild.json --filename docs/statistics.html && shx rm dist/esbuild.json
cleanshx rm -f dist/esbuild.json dist/*.js dist/*.map dist/*.css dist/img/*.svg
distrun-p dist:**
dist:mapillaryshx mkdir -p dist/mapillary-js && shx cp -R node_modules/mapillary-js/dist/* dist/mapillary-js/
dist:minnode config/esbuild.config.min.js
dist:pannellumshx mkdir -p dist/pannellum && shx cp -R node_modules/pannellum/build/* dist/pannellum/
dist:svg:communitysvg-sprite --symbol --symbol-dest . --shape-id-generator "community-%s" --symbol-sprite dist/img/community-sprite.svg node_modules/osm-community-index/dist/img/*.svg
dist:svg:fasvg-sprite --symbol --symbol-dest . --symbol-sprite dist/img/fa-sprite.svg svg/fontawesome/*.svg
dist:svg:iDsvg-sprite --symbol --symbol-dest . --shape-id-generator "iD-%s" --symbol-sprite dist/img/iD-sprite.svg "svg/iD-sprite/**/*.svg"
dist:svg:makisvg-sprite --symbol --symbol-dest . --shape-id-generator "maki-%s" --symbol-sprite dist/img/maki-sprite.svg node_modules/@mapbox/maki/icons/*.svg
dist:svg:mapillary:objectssvg-sprite --symbol --symbol-dest . --symbol-sprite dist/img/mapillary-object-sprite.svg node_modules/@rapideditor/mapillary_sprite_source/package_objects/*.svg
dist:svg:mapillary:signssvg-sprite --symbol --symbol-dest . --symbol-sprite dist/img/mapillary-sprite.svg node_modules/@rapideditor/mapillary_sprite_source/package_signs/*.svg
dist:svg:roentgensvg-sprite --shape-id-generator "roentgen-%s" --shape-dim-width 16 --shape-dim-height 16 --symbol --symbol-dest . --symbol-sprite dist/img/roentgen-sprite.svg node_modules/@enzet/roentgen/icons/*.svg
dist:svg:temakisvg-sprite --symbol --symbol-dest . --shape-id-generator "temaki-%s" --symbol-sprite dist/img/temaki-sprite.svg node_modules/@rapideditor/temaki/icons/*.svg
imagerynode scripts/update_imagery.js
linteslint config scripts test/spec modules
lint:fixeslint scripts test/spec modules --fix
startrun-s start:watch
start:servernode scripts/server.js
start:single-buildrun-p build:js start:server
start:watchrun-p build:js:watch start:server
testnpm-run-all -s lint build test:typecheck test:spec
test:oncevitest run --no-isolate
test:specvitest --no-isolate
…and 2 more.

Dependencies29

@mapbox/geojson-area^0.2.2
@mapbox/sexagesimal1.2.0
@mapbox/vector-tile^2.0.4
@rapideditor/country-coder~5.6.0
@rapideditor/location-conflation~2.0.0
@tmcw/togeojson^7.1.2
@turf/bbox^7.2.0
@turf/bbox-clip^7.2.0
abortcontroller-polyfill^1.7.8
aes-js^3.1.2
alif-toolkit^1.3.0
core-js-bundle^3.46.0
diacritics1.3.0
es-toolkit^1.45.0
exifr^7.1.3
fast-deep-equal~3.1.3
fast-equals^6.0.0
fast-json-stable-stringify2.1.0
idb-keyval^6.2.2
marked~17.0.0
node-diff3~3.2.0
osm-auth^3.1.1
pannellum2.5.7
pbf^4.0.1
polygon-clipping~0.15.7
rbush4.0.1
vitest^4.0.9
whatwg-fetch^3.6.20
which-polygon2.2.1