Package evidence

@oxyhq/[email protected]

Credential file access: matched "AWS_ACCESS_KEY"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 2
First published: Feb 2026
Publisher: nateisern

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@oxyhq/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@oxyhq/[email protected]"],"fail_on":"review"}'

Publishernateisern

Artifact bytes636,356

Previous version1.0.2

Published2026-05-27T23:58:13.840Z

SHA-256100c6ff0c5b42ec79688543d7e56c3735d58d88cac81ce4a3726818b847ae698

Why flagged

What the scanner saw

Credential file access: matched "AWS_ACCESS_KEY"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

17d agoLast checked

reviewRisk

40Score

1.0.3Version

Status history (2 events)

available → available17d ago · risk review · score 40 · status available -> available, risk high -> review, score 115 -> 40
new → available20d ago · risk high · score 115 · status changed

Evidence

Static findings

8 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 8 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Credential file access	package/dist/routes/assets.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/dist/config/email.config.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/dist/config/env.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/dist/services/federation.service.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/src/routes/assets.ts	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/src/config/email.config.ts	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/src/config/env.ts	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/src/services/federation.service.ts	matched "AWS_ACCESS_KEY"	5

Manifest

Package metadata

Scripts12

buildtsc
cleanrm -rf dist
devbun --watch src/server.ts
linteslint .
lint:fixeslint . --fix
migrate:locationsbun run src/utils/migrateLocations.ts
openapi:generatebun scripts/generate-openapi.ts
releaserm -rf dist && bun run build && release-it
startnode dist/server.js
testjest
test:coveragejest --coverage
test:watchjest --watch

Dependencies46

@aws-sdk/client-s3^3.857.0
@aws-sdk/s3-request-presigner^3.857.0
@node-rs/argon2^2.0.2
@socket.io/redis-adapter^8.3.0
@types/cheerio^0.22.35
@types/compression^1.8.1
@types/cookie-parser^1.4.10
@types/elliptic^6.4.18
@types/express^4.17.21
@types/express-rate-limit^5.1.3
@types/jsonwebtoken^9.0.8
@types/mailparser^3.4.6
@types/multer^1.4.12
@types/node^22.0.0
@types/nodemailer^7.0.9
@types/smtp-server^3.5.12
@types/uuid^10.0.0
@types/ws^8.18.1
axios^1.7.9
cheerio^1.1.2
compression^1.8.1
cookie-parser^1.4.7
dotenv^16.4.7
elliptic^6.6.1
express^4.21.2
express-rate-limit^7.5.0
express-slow-down^2.0.3
gridfs-stream^1.1.1
helmet^8.0.0
ioredis^5.9.2
…and 16 more.

Optional dependencies2

ffmpeg-static^5.2.0
ffprobe-static^3.1.0