Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 122
- Versions published
- 13
- First published
- May 2026
- Publisher
- cafe_reo
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@ps-neko/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@ps-neko/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Credential file access: matched "AWS_ACCESS_KEY"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 3 · status changed
Evidence
Static findings
1 static · 0 from release diff · showing high-signal first.
No high-signal findings — see all findings below.
Show all 1 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| low | Credential file access | package/agent.yaml | matched "AWS_ACCESS_KEY" | 3 |
Manifest
Package metadata
Scripts32
auth:github:import-ghnode scripts/auth/github-import-gh.jsauth:github:loginnode scripts/auth/github-login.jsauth:github:logoutnode scripts/auth/github-logout.jsauth:github:statusnode scripts/auth/github-status.jsbench:rulesnode scripts/benchmark/rules.jsbuildecho 'build: harness-specific projection scripts run via prepack' && exit 0build:claudenode scripts/build-claude.jsbuild:codemapsnode scripts/build-codemaps.jsbuild:codexnode scripts/build-codex.jsbuild:cursornode scripts/build-cursor.jsbuild:gemininode scripts/build-gemini.jsdemo:externalnode scripts/demo-external-project.jsdemo:quicknode scripts/demo-quick-run.jsinstall:applynode scripts/install-apply.jsinstall:plannode scripts/install-plan.jslintnode scripts/ci/catalog.js && npm run validate:all && npm run security:hardening && node scripts/ci/check-version.jssecurity:hardeningnode scripts/ci/security-hardening.jstestnode --test tests/unit/*.test.js tests/integration/*.test.js tests/e2e/*.test.jstest:catalognode scripts/ci/catalog.jstest:e2enode --test tests/e2e/*.test.jstest:integrationnode --test tests/integration/*.test.jstest:keychainnode --test tests/optional/keychain-smoke.test.jstest:unitnode --test tests/unit/*.test.jsvalidate:agentsnode scripts/ci/validate-agents.jsvalidate:allnpm run validate:agents && npm run validate:skills && npm run validate:hooks && npm run validate:manifestsvalidate:hooksnode scripts/ci/validate-hooks.jsvalidate:manifestsnode scripts/ci/validate-manifests.jsvalidate:skillsnode scripts/ci/validate-skills.jsverify:claudenode scripts/verify/claude-live.jsverify:codexnode scripts/verify/codex-live.js- …and 2 more.
Dependencies5
@modelcontextprotocol/sdk^1.29.0@napi-rs/keyring^1.2.0ajv^8.17.1ajv-formats^3.0.1yaml^2.6.1
Optional dependencies1
@anthropic-ai/sdk^0.92.0