Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Versions published
- 2
- First published
- Jun 2026
- Publisher
- jeyrb
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@rhizomatics/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@rhizomatics/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Credential file access: matched "aws_access_key"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 30 · status changed
Evidence
Static findings
22 static · 0 from release diff · showing high-signal first.
No high-signal findings — see all findings below.
Show all 22 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| low | Credential file access | package/public/assets/add-connection-dialog-_nMyst1l.js | matched "aws_access_key" | 5 |
| low | Credential file access | package/public/assets/add-connection-dialog-8ChtH4mo.js | matched "aws_access_key" | 5 |
| low | Credential file access | package/public/assets/add-connection-dialog-CzxRpS5F.js | matched "aws_access_key" | 5 |
| low | Credential file access | package/public/assets/ai-model-dropdown-B-9yxYM4.js | matched ".aws/" | 5 |
| low | Credential file access | package/public/assets/ai-model-dropdown-BFTnsrTP.js | matched ".aws/" | 5 |
| low | Credential file access | package/public/assets/ai-model-dropdown-CjhUqXgj.js | matched ".aws/" | 5 |
| low | Obfuscation Density | package/public/assets/chunk-5FQGJX7Z-BSzccEgu.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/public/assets/chunk-5FQGJX7Z-e_arGD4o.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/public/assets/chunk-B4BG7PRW-Bg43tpY1.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/public/assets/chunk-B4BG7PRW-jxe9_Hde.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/public/assets/edit-page-BiwFohnL.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/public/assets/edit-page-Ct5Ke1wi.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/public/assets/edit-page-D_MrFGP2.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/public/assets/flowDiagram-NV44I4VS-CXUevMnh.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/public/assets/flowDiagram-NV44I4VS-LeaIbfPS.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/public/assets/index-BMxMikGP.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/public/assets/index-CL4WR8q8.js | high encoded/escaped-token density | 0 |
| low | Large Javascript Payload | package/public/assets/node-sql-parser-B8vXamqL.js | 2598327 bytes | 0 |
| low | Large Javascript Payload | package/public/assets/node-sql-parser-BvUFblwL.js | 2598327 bytes | 0 |
| low | Large Javascript Payload | package/public/assets/Plot-BDBiXfv_.js | 4827160 bytes | 0 |
| low | Large Javascript Payload | package/public/assets/Plot-IawheWsD.js | 4827160 bytes | 0 |
| low | Obfuscation Density | package/public/assets/zod-H_cgTO0M.js | high encoded/escaped-token density | 0 |
Manifest
Package metadata
Scripts6
buildnpm run build:ts && npm run build:wasmbuild:iconsrsvg-convert -w 512 -h 512 assets/logo.svg -o public/android-chrome-512x512.png && rsvg-convert -w 192 -h 192 assets/logo.svg -o public/android-chrome-192x192.png && rsvg-convert -w 180 -h 180 assets/logo.svg -o public/apple-touch-icon.png && rsvg-convert -w 32 -h 32 assets/logo.svg -o public/favicon-32x32.png && rsvg-convert -w 16 -h 16 assets/logo.svg -o public/favicon-16x16.png && cp assets/logo.svg public/logo.svgbuild:tstscbuild:wasmuv run --with marimo marimo export html-wasm notebooks/signalk.py -o public/ --mode edit -f && npm run build:icons && cp notebooks/CLAUDE.md public/prepacknpm run buildwatchtsc --watch
Dependencies2
@signalk/server-api>=2.22.0express>=4