PkgRadar

Package evidence

@psnext/[email protected]

Remote Payload: matched "github.com/repos/${t}/releases/latest`,{headers:{\"User-Agent\":`${Wt}-coding-agent`},signal:AbortSignal.timeout(jD)});if(!e.ok)throw new Error(`GitHub API error: ${e.status}`);return(await e.json()).tag_name.replace(/^v/,\"\")}async function VD(t,e){let n=await fetch(t,{signal:AbortSignal.timeout(qD)});if(!n.ok)throw new Error(`Failed to download: ${n.status}`);if(!n.body)throw new Error(\"No response body\");let i=UD(e);await ND(BD.fromWeb(n.body),i)}function JD(t,e){let n=[t];for(;n.length>0;){let i=n.pop();if(!i)continue;let s=FD(i,{withFileTypes:!0});for(let r of s){let o=ji(i,r.name);if(r.isFile()&&r.name===e)return o;r.isDirectory()&&n.push(o)}}return null}function QD(t){if(t.error?.message)return t.error.message;let e=t.stderr?.toString().trim();if(e)return e;let n=t.stdout?.toString().trim();return n||`exit status ${t.status??\"unknown\"}`}function Rl(t,e){let n=bk(t,e,{stdio:\"pipe\"});return!n.error&&n.status===0?null:`${t}: ${QD(n)}`}function YD(t,e,n){let i=Rl(\"tar\",[\"xzf\",t,\"-C\",e]);if(i)throw new Error(`Failed to extract ${n}: ${i}`)}function XD(){let t=process.env.SystemRoot??process.env.WINDIR;if(t){let e=ji(t,\"System32\",\"tar.exe\");if(Nf(e))return e}return\"tar.exe\"}function ZD(t,e,n){let i=[];if(hp()===\"win32\"){let s=Rl(XD(),[\"xf\",t,\"-C\",e]);if(!s)return;i.push(s);let o=Rl(\"powershell.exe\",[\"-NoLogo\",\"-NoProfile\",\"-NonInteractive\",\"-ExecutionPolicy\",\"Bypass\",\"-Command\",\"& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }\",t,e]);if(!o)return;i.push(o)}else{let s=Rl(\"unzip\",[\"-q\",t,\"-d\",e]);if(!s)return;i.push(s);let r=Rl(\"tar\",[\"xf\",t,\"-C\",e]);if(!r)return;i.push(r)}throw new Error(`Failed to extract ${n}: ${i.join(\"; \")}`)}async function e3(t){let e=jf[t];if(!e)throw new Error(`Unknown tool: ${t}`);let n=hp(),i=$D(),s=await zD(e.repo);t===\"fd\"&&n===\"darwin\"&&i===\"x64\"&&(s=\"10.3.0\");let r=e.getAssetName(s,n,i);if(!r)throw new Error(`Unsupported platform: ${n}/${i}`);gk(Il,{recursive:!0});let o=`https://github.com/${e.repo}/releases/download"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
4,860Niche · −30% score
Versions published
36
First published
May 2026
Publisher
rravuri

Effective trust discount applied: 30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@psnext/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@psnext/[email protected]"],"fail_on":"review"}'
Publisherrravuri
Artifact bytes17,119,733
Previous version2.4.20260527-2
Published2026-05-27T16:57:54.092Z
SHA-25632abf293f3e1fa142b7bcc340db2d526d0a0b2e5b263beba4561ec487f47db73

Why flagged

What the scanner saw

Remote Payload: matched "github.com/repos/${t}/releases/latest`,{headers:{\"User-Agent\":`${Wt}-coding-agent`},signal:AbortSignal.timeout(jD)});if(!e.ok)throw new Error(`GitHub API error: ${e.status}`);return(await e.json()).tag_name.replace(/^v/,\"\")}async function VD(t,e){let n=await fetch(t,{signal:AbortSignal.timeout(qD)});if(!n.ok)throw new Error(`Failed to download: ${n.status}`);if(!n.body)throw new Error(\"No response body\");let i=UD(e);await ND(BD.fromWeb(n.body),i)}function JD(t,e){let n=[t];for(;n.length>0;){let i=n.pop();if(!i)continue;let s=FD(i,{withFileTypes:!0});for(let r of s){let o=ji(i,r.name);if(r.isFile()&&r.name===e)return o;r.isDirectory()&&n.push(o)}}return null}function QD(t){if(t.error?.message)return t.error.message;let e=t.stderr?.toString().trim();if(e)return e;let n=t.stdout?.toString().trim();return n||`exit status ${t.status??\"unknown\"}`}function Rl(t,e){let n=bk(t,e,{stdio:\"pipe\"});return!n.error&&n.status===0?null:`${t}: ${QD(n)}`}function YD(t,e,n){let i=Rl(\"tar\",[\"xzf\",t,\"-C\",e]);if(i)throw new Error(`Failed to extract ${n}: ${i}`)}function XD(){let t=process.env.SystemRoot??process.env.WINDIR;if(t){let e=ji(t,\"System32\",\"tar.exe\");if(Nf(e))return e}return\"tar.exe\"}function ZD(t,e,n){let i=[];if(hp()===\"win32\"){let s=Rl(XD(),[\"xf\",t,\"-C\",e]);if(!s)return;i.push(s);let o=Rl(\"powershell.exe\",[\"-NoLogo\",\"-NoProfile\",\"-NonInteractive\",\"-ExecutionPolicy\",\"Bypass\",\"-Command\",\"& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }\",t,e]);if(!o)return;i.push(o)}else{let s=Rl(\"unzip\",[\"-q\",t,\"-d\",e]);if(!s)return;i.push(s);let r=Rl(\"tar\",[\"xf\",t,\"-C\",e]);if(!r)return;i.push(r)}throw new Error(`Failed to extract ${n}: ${i.join(\"; \")}`)}async function e3(t){let e=jf[t];if(!e)throw new Error(`Unknown tool: ${t}`);let n=hp(),i=$D(),s=await zD(e.repo);t===\"fd\"&&n===\"darwin\"&&i===\"x64\"&&(s=\"10.3.0\");let r=e.getAssetName(s,n,i);if(!r)throw new Error(`Unsupported platform: ${n}/${i}`);gk(Il,{recursive:!0});let o=`https://github.com/${e.repo}/releases/download"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
86Score
2.4.20260527-3Version
Status history (1 event)
  1. newavailable · risk review · score 86 · status changed

Evidence

Static findings

37 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/slingshot/index.jsmatched "github.com/repos/${t}/releases/latest`,{headers:{\"User-Agent\":`${Wt}-coding-agent`},signal:AbortSignal.timeout(jD)});if(!e.ok)throw new Error(`GitHub API error: ${e.status}`);return(await e.json()).tag_name.replace(/^v/,\"\")}async function VD(t,e){let n=await fetch(t,{signal:AbortSignal.timeout(qD)});if(!n.ok)throw new Error(`Failed to download: ${n.status}`);if(!n.body)throw new Error(\"No response body\");let i=UD(e);await ND(BD.fromWeb(n.body),i)}function JD(t,e){let n=[t];for(;n.length>0;){let i=n.pop();if(!i)continue;let s=FD(i,{withFileTypes:!0});for(let r of s){let o=ji(i,r.name);if(r.isFile()&&r.name===e)return o;r.isDirectory()&&n.push(o)}}return null}function QD(t){if(t.error?.message)return t.error.message;let e=t.stderr?.toString().trim();if(e)return e;let n=t.stdout?.toString().trim();return n||`exit status ${t.status??\"unknown\"}`}function Rl(t,e){let n=bk(t,e,{stdio:\"pipe\"});return!n.error&&n.status===0?null:`${t}: ${QD(n)}`}function YD(t,e,n){let i=Rl(\"tar\",[\"xzf\",t,\"-C\",e]);if(i)throw new Error(`Failed to extract ${n}: ${i}`)}function XD(){let t=process.env.SystemRoot??process.env.WINDIR;if(t){let e=ji(t,\"System32\",\"tar.exe\");if(Nf(e))return e}return\"tar.exe\"}function ZD(t,e,n){let i=[];if(hp()===\"win32\"){let s=Rl(XD(),[\"xf\",t,\"-C\",e]);if(!s)return;i.push(s);let o=Rl(\"powershell.exe\",[\"-NoLogo\",\"-NoProfile\",\"-NonInteractive\",\"-ExecutionPolicy\",\"Bypass\",\"-Command\",\"& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }\",t,e]);if(!o)return;i.push(o)}else{let s=Rl(\"unzip\",[\"-q\",t,\"-d\",e]);if(!s)return;i.push(s);let r=Rl(\"tar\",[\"xf\",t,\"-C\",e]);if(!r)return;i.push(r)}throw new Error(`Failed to extract ${n}: ${i.join(\"; \")}`)}async function e3(t){let e=jf[t];if(!e)throw new Error(`Unknown tool: ${t}`);let n=hp(),i=$D(),s=await zD(e.repo);t===\"fd\"&&n===\"darwin\"&&i===\"x64\"&&(s=\"10.3.0\");let r=e.getAssetName(s,n,i);if(!r)throw new Error(`Unsupported platform: ${n}/${i}`);gk(Il,{recursive:!0});let o=`https://github.com/${e.repo}/releases/download"12
mediumObfuscation Densitypackage/node_modules/@earendil-works/pi-coding-agent/npm-shrinkwrap.jsonhigh encoded/escaped-token density12
mediumCredential file accesspackage/slingshot/index.jsmatched "GOOGLE_APPLICATION_CREDENTIALS"10
Show all 37 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/slingshot/index.jsmatched "github.com/repos/${t}/releases/latest`,{headers:{\"User-Agent\":`${Wt}-coding-agent`},signal:AbortSignal.timeout(jD)});if(!e.ok)throw new Error(`GitHub API error: ${e.status}`);return(await e.json()).tag_name.replace(/^v/,\"\")}async function VD(t,e){let n=await fetch(t,{signal:AbortSignal.timeout(qD)});if(!n.ok)throw new Error(`Failed to download: ${n.status}`);if(!n.body)throw new Error(\"No response body\");let i=UD(e);await ND(BD.fromWeb(n.body),i)}function JD(t,e){let n=[t];for(;n.length>0;){let i=n.pop();if(!i)continue;let s=FD(i,{withFileTypes:!0});for(let r of s){let o=ji(i,r.name);if(r.isFile()&&r.name===e)return o;r.isDirectory()&&n.push(o)}}return null}function QD(t){if(t.error?.message)return t.error.message;let e=t.stderr?.toString().trim();if(e)return e;let n=t.stdout?.toString().trim();return n||`exit status ${t.status??\"unknown\"}`}function Rl(t,e){let n=bk(t,e,{stdio:\"pipe\"});return!n.error&&n.status===0?null:`${t}: ${QD(n)}`}function YD(t,e,n){let i=Rl(\"tar\",[\"xzf\",t,\"-C\",e]);if(i)throw new Error(`Failed to extract ${n}: ${i}`)}function XD(){let t=process.env.SystemRoot??process.env.WINDIR;if(t){let e=ji(t,\"System32\",\"tar.exe\");if(Nf(e))return e}return\"tar.exe\"}function ZD(t,e,n){let i=[];if(hp()===\"win32\"){let s=Rl(XD(),[\"xf\",t,\"-C\",e]);if(!s)return;i.push(s);let o=Rl(\"powershell.exe\",[\"-NoLogo\",\"-NoProfile\",\"-NonInteractive\",\"-ExecutionPolicy\",\"Bypass\",\"-Command\",\"& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }\",t,e]);if(!o)return;i.push(o)}else{let s=Rl(\"unzip\",[\"-q\",t,\"-d\",e]);if(!s)return;i.push(s);let r=Rl(\"tar\",[\"xf\",t,\"-C\",e]);if(!r)return;i.push(r)}throw new Error(`Failed to extract ${n}: ${i.join(\"; \")}`)}async function e3(t){let e=jf[t];if(!e)throw new Error(`Unknown tool: ${t}`);let n=hp(),i=$D(),s=await zD(e.repo);t===\"fd\"&&n===\"darwin\"&&i===\"x64\"&&(s=\"10.3.0\");let r=e.getAssetName(s,n,i);if(!r)throw new Error(`Unsupported platform: ${n}/${i}`);gk(Il,{recursive:!0});let o=`https://github.com/${e.repo}/releases/download"12
mediumObfuscation Densitypackage/node_modules/@earendil-works/pi-coding-agent/npm-shrinkwrap.jsonhigh encoded/escaped-token density12
mediumCredential file accesspackage/slingshot/index.jsmatched "GOOGLE_APPLICATION_CREDENTIALS"10
lowCredential file accesspackage/node_modules/@earendil-works/pi-coding-agent/dist/cli/args.jsmatched ".azure"5
lowCredential file accesspackage/node_modules/@earendil-works/pi-ai/dist/providers/azure-openai-responses.jsmatched ".azure"5
lowCredential file accesspackage/node_modules/@aws-sdk/nested-clients/dist-es/submodules/signin/endpoint/bdd.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/google-auth-library/build/src/auth/defaultawssecuritycredentialssupplier.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/node_modules/@aws-sdk/client-bedrock-runtime/dist-es/models/enums.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/node_modules/@earendil-works/pi-ai/dist/env-api-keys.jsmatched "GOOGLE_APPLICATION_CREDENTIALS"5
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getConfigFilepath.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getCredentialsFilepath.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@smithy/credential-provider-imds/dist-es/utils/getExtendedInstanceMetadataCredentials.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/google-auth-library/build/src/auth/googleauth.jsmatched "GOOGLE_APPLICATION_CREDENTIALS"5
lowCredential file accesspackage/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.browser.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@aws-sdk/client-bedrock-runtime/dist-cjs/index.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-env/dist-cjs/index.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-ini/dist-cjs/index.jsmatched "aws_access_key"5
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-login/dist-cjs/index.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-node/dist-cjs/index.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-sso/dist-cjs/index.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/signin/index.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@smithy/core/dist-cjs/submodules/config/index.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@smithy/credential-provider-imds/dist-cjs/index.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@smithy/node-http-handler/dist-cjs/index.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.native.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@smithy/node-http-handler/dist-es/node-http-handler.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@aws-sdk/core/dist-es/submodules/client/util-endpoints/lib/aws/partitions.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveStaticCredentials.jsmatched "aws_access_key"5
lowCredential file accesspackage/bin/sling.jsmatched "GITHUB_TOKEN"5
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-sso/dist-es/validateSsoProfile.jsmatched ".aws"5
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-ini/package.jsonmatched ".aws"3
lowCredential file accesspackage/node_modules/@aws-sdk/credential-provider-process/package.jsonmatched ".aws"3

Manifest

Package metadata

Dependencies6
  • @earendil-works/pi-agent-corefile:../.sling-pack/earendil-works-pi-agent-core-0.75.5.tgz
  • @earendil-works/pi-aifile:../.sling-pack/earendil-works-pi-ai-0.75.5.tgz
  • @earendil-works/pi-coding-agentfile:../.sling-pack/earendil-works-pi-coding-agent-0.75.5.tgz
  • @earendil-works/pi-tuifile:../.sling-pack/earendil-works-pi-tui-0.75.5.tgz
  • semver^7.6.0
  • undici^7.19.1