Package evidence

@rancher/[email protected]

Credential file access: matched "KUBECONFIG"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,189Niche · −30% score
Versions published: 118Mature · −50% score
First published: May 2022
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@rancher/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@rancher/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes4,417,655

Previous version3.0.12-rc.1

Published2026-05-04T11:04:25.058Z

SHA-256b8118db1b691f2711ad61c9156f0b8cebf49b874cd6ef205aa3c43365dad0dde

Why flagged

What the scanner saw

Credential file access: matched "KUBECONFIG"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

20d agoLast checked

reviewRisk

10Score

3.0.12-rc.2Version

Status history (1 event)

new → available20d ago · risk review · score 10 · status changed

Evidence

Static findings

8 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 8 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Credential file access	package/models/management.cattle.io.cluster.js	matched "KUBECONFIG"	5
low	Credential file access	package/config/product/manager.js	matched "KUBECONFIG"	5
low	Credential file access	package/models/provisioning.cattle.io.cluster.js	matched "KubeConfig"	5
low	Credential file access	package/config/types.js	matched "kubeconfig"	5
low	Credential file access	package/models/ext.cattle.io.kubeconfig.ts	matched "kubeconfig"	5
low	Credential file access	package/config/settings.ts	matched "kubeconfig"	5
low	Credential file access	package/assets/translations/en-us.yaml	matched "kubeconfig"	3
low	Credential file access	package/assets/translations/zh-hans.yaml	matched "kubeconfig"	3

Manifest

Package metadata

Scripts12

analyze./node_modules/.bin/vue-cli-service build --report
build./node_modules/.bin/vue-cli-service build
clean./scripts/clean
cy:opencypress open
cy:runcypress run
dev./node_modules/.bin/vue-cli-service dev
e2e:devstart-server-and-test dev https://localhost:8005 cy:open
e2e:preNODE_ENV=dev yarn build
e2e:runNODE_ENV=dev START_SERVER_AND_TEST_INSECURE=1 start-server-and-test start https://localhost:8005/ cy:run
lint./node_modules/.bin/eslint --max-warnings 0 --ext .ts,.js,.vue .
start./node_modules/.bin/vue-cli-service start
test./node_modules/.bin/nyc ava --serial --verbose

Dependencies121

@aws-sdk/client-ec23.863.0
@aws-sdk/client-eks3.879.0
@aws-sdk/client-iam3.863.0
@aws-sdk/client-kms3.863.0
@babel/plugin-proposal-optional-chaining7.21.0
@babel/plugin-proposal-private-methods7.18.6
@babel/plugin-proposal-private-property-in-object7.14.5
@babel/preset-typescript7.16.7
@novnc/novnc1.2.0
@popperjs/core2.11.8
@rancher/icons2.0.55
@smithy/fetch-http-handler5.1.1
@types/is-url1.2.30
@types/node25.3.3
@types/semver^7.5.8
@typescript-eslint/eslint-plugin5.62.0
@typescript-eslint/parser5.62.0
@vue/cli-plugin-babel~5.0.0
@vue/cli-plugin-typescript~5.0.0
@vue/cli-service5.0.8
@vue/test-utils2.4.6
@vue/vue3-jest27.0.0
add2.0.6
ansi_up5.0.0
axios1.15.0
axios-retry3.1.9
babel-eslint10.1.0
babel-plugin-module-resolver5.0.2
babel-preset-vue2.0.2
cache-loader4.1.0
…and 91 more.