Package evidence

@pulumi/[email protected]

Credential file access: matched ".aws"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Publisher: pulumi-botTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@pulumi/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@pulumi/[email protected]"],"fail_on":"high"}'

Publisherpulumi-bot

Artifact bytes5,620,504

Previous version7.31.0-alpha.1779348527

Published2026-05-22T09:27:44.748Z

SHA-256841273a5e9f05e15ee71576e0b51a88731eb1fe7f6509a9c1ba691ab0db1fb93

Why flagged

What the scanner saw

Credential file access: matched ".aws"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

20d agoLast checked

highRisk

15231Score

7.31.0-alpha.1779436740Version

Status history (1 event)

new → available20d ago · risk high · score 15231 · status changed

Related candidates

Linked campaigns and clusters

Repeated static TTPstale

Credential file access — matched ".Ssh"

2 members · evidence strength 70

Evidence

Static findings

511 static · 0 from release diff · showing high-signal first.

Showing 30 of 508 findings.

Severity	Kind	Path	Detail	Points
high	Credential file access	package/s3/accessPoint.js	matched ".aws"	30
high	Credential file access	package/macie2/account.js	matched ".aws"	30
high	Credential file access	package/organizations/account.js	matched ".aws"	30
high	Credential file access	package/iam/accountPasswordPolicy.js	matched ".aws"	30
high	Credential file access	package/s3/accountPublicAccessBlock.js	matched ".aws"	30
high	Credential file access	package/ecs/accountSettingDefault.js	matched ".aws"	30
high	Credential file access	package/quicksight/accountSettings.js	matched ".aws"	30
high	Credential file access	package/quicksight/accountSubscription.js	matched ".aws"	30
high	Credential file access	package/memorydb/acl.js	matched ".aws"	30
high	Credential file access	package/sfn/activity.js	matched ".aws"	30
high	Credential file access	package/eks/addon.js	matched ".aws"	30
high	Credential file access	package/bedrock/agentDataSource.js	matched ".aws"	30
high	Credential file access	package/kms/alias.js	matched ".aws"	30
high	Credential file access	package/lambda/alias.js	matched ".aws"	30
high	Credential file access	package/ec2/allowedImagesSettings.js	matched ".aws"	30
high	Credential file access	package/quicksight/analysis.js	matched ".aws"	30
high	Credential file access	package/kinesis/analyticsApplication.js	matched ".aws"	30
high	Credential file access	package/s3/analyticsConfiguration.js	matched ".aws"	30
high	Credential file access	package/accessanalyzer/analyzer.js	matched ".aws"	30
high	Credential file access	package/appsync/api.js	matched ".aws"	30
high	Credential file access	package/apigatewayv2/apiMapping.js	matched ".aws"	30
high	Credential file access	package/amplify/app.js	matched ".aws"	30
high	Credential file access	package/m2/application.js	matched ".aws"	30
high	Credential file access	package/opensearch/application.js	matched ".aws"	30
high	Credential file access	package/accessanalyzer/archiveRule.js	matched ".aws"	30
high	Credential file access	package/ec2clientvpn/authorizationRule.js	matched ".aws"	30
high	Credential file access	package/apigatewayv2/authorizer.js	matched ".aws"	30
high	Credential file access	package/securitylake/awsLogSource.js	matched ".Aws"	30
high	Credential file access	package/organizations/awsServiceAccess.js	matched ".Aws"	30
high	Credential file access	package/directconnect/bgpPeer.js	matched ".aws"	30

Show all 511 findings (low-signal and informational)

Showing 60 of 511 findings.

Severity	Kind	Path	Detail	Points
high	Credential file access	package/s3/accessPoint.js	matched ".aws"	30
high	Credential file access	package/macie2/account.js	matched ".aws"	30
high	Credential file access	package/organizations/account.js	matched ".aws"	30
high	Credential file access	package/iam/accountPasswordPolicy.js	matched ".aws"	30
high	Credential file access	package/s3/accountPublicAccessBlock.js	matched ".aws"	30
high	Credential file access	package/ecs/accountSettingDefault.js	matched ".aws"	30
high	Credential file access	package/quicksight/accountSettings.js	matched ".aws"	30
high	Credential file access	package/quicksight/accountSubscription.js	matched ".aws"	30
high	Credential file access	package/memorydb/acl.js	matched ".aws"	30
high	Credential file access	package/sfn/activity.js	matched ".aws"	30
high	Credential file access	package/eks/addon.js	matched ".aws"	30
high	Credential file access	package/bedrock/agentDataSource.js	matched ".aws"	30
high	Credential file access	package/kms/alias.js	matched ".aws"	30
high	Credential file access	package/lambda/alias.js	matched ".aws"	30
high	Credential file access	package/ec2/allowedImagesSettings.js	matched ".aws"	30
high	Credential file access	package/quicksight/analysis.js	matched ".aws"	30
high	Credential file access	package/kinesis/analyticsApplication.js	matched ".aws"	30
high	Credential file access	package/s3/analyticsConfiguration.js	matched ".aws"	30
high	Credential file access	package/accessanalyzer/analyzer.js	matched ".aws"	30
high	Credential file access	package/appsync/api.js	matched ".aws"	30
high	Credential file access	package/apigatewayv2/apiMapping.js	matched ".aws"	30
high	Credential file access	package/amplify/app.js	matched ".aws"	30
high	Credential file access	package/m2/application.js	matched ".aws"	30
high	Credential file access	package/opensearch/application.js	matched ".aws"	30
high	Credential file access	package/accessanalyzer/archiveRule.js	matched ".aws"	30
high	Credential file access	package/ec2clientvpn/authorizationRule.js	matched ".aws"	30
high	Credential file access	package/apigatewayv2/authorizer.js	matched ".aws"	30
high	Credential file access	package/securitylake/awsLogSource.js	matched ".Aws"	30
high	Credential file access	package/organizations/awsServiceAccess.js	matched ".Aws"	30
high	Credential file access	package/directconnect/bgpPeer.js	matched ".aws"	30
high	Credential file access	package/emr/blockPublicAccessConfiguration.js	matched ".aws"	30
high	Credential file access	package/lex/bot.js	matched ".aws"	30
high	Credential file access	package/lex/botAlias.js	matched ".aws"	30
high	Credential file access	package/connect/botAssociation.js	matched ".aws"	30
high	Credential file access	package/amplify/branch.js	matched ".aws"	30
high	Credential file access	package/mq/broker.js	matched ".aws"	30
high	Credential file access	package/s3/bucket.js	matched ".aws"	30
high	Credential file access	package/s3control/bucket.js	matched ".aws"	30
high	Credential file access	package/s3/bucketAbac.js	matched ".aws"	30
high	Credential file access	package/s3/bucketAccelerateConfiguration.js	matched ".aws"	30
high	Credential file access	package/s3/bucketAccelerateConfigurationV2.js	matched ".aws"	30
high	Credential file access	package/s3/bucketAcl.js	matched ".aws"	30
high	Credential file access	package/s3/bucketAclV2.js	matched ".aws"	30
high	Credential file access	package/s3/bucketCorsConfiguration.js	matched ".aws"	30
high	Credential file access	package/s3/bucketCorsConfigurationV2.js	matched ".aws"	30
high	Credential file access	package/s3/bucketIntelligentTieringConfiguration.js	matched ".aws"	30
high	Credential file access	package/s3/bucketLifecycleConfiguration.js	matched ".aws"	30
high	Credential file access	package/s3control/bucketLifecycleConfiguration.js	matched ".aws"	30
high	Credential file access	package/s3/bucketLifecycleConfigurationV2.js	matched ".aws"	30
high	Credential file access	package/s3/bucketLogging.js	matched ".aws"	30
high	Credential file access	package/s3/bucketLoggingV2.js	matched ".aws"	30
high	Credential file access	package/s3/bucketMetric.js	matched ".aws"	30
high	Credential file access	package/s3/bucketNotification.js	matched ".aws"	30
high	Credential file access	package/s3/bucketObjectLockConfiguration.js	matched ".aws"	30
high	Credential file access	package/s3/bucketObjectLockConfigurationV2.js	matched ".aws"	30
high	Credential file access	package/s3/bucketObjectv2.js	matched ".aws"	30
high	Credential file access	package/s3/bucketOwnershipControls.js	matched ".aws"	30
high	Credential file access	package/s3control/bucketPolicy.js	matched ".aws"	30
high	Credential file access	package/s3/bucketPublicAccessBlock.js	matched ".aws"	30
high	Credential file access	package/s3/bucketReplicationConfig.js	matched ".aws"	30

Manifest

Package metadata

Scripts1

buildtsc

Dependencies2

@pulumi/pulumi^3.142.0
mime^2.0.0