PkgRadar

Package evidence

@pellux/[email protected]

Credential file access: matched ".npmrc"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
19,509Mainstream · −50% score
Versions published
153
First published
May 2026
Publisher
mgd34msu

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@pellux/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@pellux/[email protected]"],"fail_on":"review"}'
Publishermgd34msu
Artifact bytes11,380,111
Previous version1.0.36
Published2026-06-05T02:18:39.874Z
SHA-25612ebc79d21e02964299dcfdf544da54ac40b72e558e9d35f8b1a3291aa59cfc6

Why flagged

What the scanner saw

Credential file access: matched ".npmrc"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
2Score
1.0.37Version
Status history (1 event)
  1. new → available · risk review · score 2 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/src/tools/agent-read-policy.tsmatched ".npmrc"5
lowLarge Javascript Payloadpackage/dist/package/main.js37497474 bytes0

Manifest

Package metadata

Scripts29
  • architecture:checkbun run scripts/check-architecture.ts
  • buildbun build src/main.ts --compile --outfile dist/goodvibes-agent
  • build:allbun run scripts/build.ts --all
  • build:all-shellbun run build:linux-x64 && bun run build:linux-arm64 && bun run build:macos-x64 && bun run build:macos-arm64 && bun run build:windows
  • build:linux-arm64bun build src/main.ts --compile --target=bun-linux-arm64 --outfile dist/goodvibes-agent-linux-arm64
  • build:linux-x64bun build src/main.ts --compile --target=bun-linux-x64 --outfile dist/goodvibes-agent-linux-x64
  • build:macos-arm64bun build src/main.ts --compile --target=bun-darwin-arm64 --outfile dist/goodvibes-agent-macos-arm64
  • build:macos-x64bun build src/main.ts --compile --target=bun-darwin-x64 --outfile dist/goodvibes-agent-macos-x64
  • build:package-runtimebun run scripts/build-package-runtime.ts
  • build:prodbun run scripts/build.ts
  • build:windowsbun build src/main.ts --compile --target=bun-windows-x64 --outfile dist/goodvibes-agent-windows.exe
  • check:typesbun run typecheck
  • ci:gatebun run typecheck && bun run test && bun run architecture:check && bun run perf:check && bun run build && bun run publish:check && bun run package:install-check && bun run verification:ledger
  • devbun run src/main.ts
  • dev:watchbun --watch src/main.ts
  • package:install-checkbun run scripts/package-install-check.ts
  • perf:checkbun run scripts/perf-check.ts
  • prebuildbun run scripts/prebuild.ts
  • publish:checkbun run scripts/publish-check.ts
  • publish:dry-runbun run scripts/publish-package.ts --dry-run
  • publish:packagebun run scripts/publish-package.ts
  • releasebun run scripts/release.ts
  • release:drybun run scripts/release.ts --dry-run
  • testbun run scripts/run-tests.ts
  • tuibun run src/main.ts
  • typecheckbunx tsc --noEmit
  • verification:ledgerbun run scripts/verification-ledger.ts
  • verification:livebun run scripts/verify-live.ts
  • versionbun run scripts/prebuild.ts