Package evidence

@ritbit/[email protected]

Credential File Packaged: package/.env

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 51
Versions published: 24Established · −30% score
First published: Dec 2025
Publisher: ritbit

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@ritbit/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@ritbit/[email protected]"],"fail_on":"high"}'

Publisherritbit

Artifact bytes10,642,216

Previous version2.2.6

Published2026-02-27T10:21:29.057Z

SHA-2561f7dab311d4dd69b4d4e2d1b8cd095027c3aa7eb1bc1a4173cd6c5deb6a90ddd

Why flagged

What the scanner saw

Credential File Packaged: package/.env

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

3d agoLast checked

highRisk

24Score

2.3.0Version

Status history (1 event)

new → available4d ago · risk high · score 24 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Credential File Packaged	package/.env	package/.env	35

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Credential File Packaged	package/.env	package/.env	35
low	Large Javascript Payload	package/__native__/__ios__/v4-native-client.js	10123784 bytes	0

Manifest

Package metadata

Scripts18

buildrm -rf build/ && npm run build:esm && npm run build:cjs && npm run fix-package-json
build:cjstsc -p tsconfig.cjs.json
build:esmtsc -p tsconfig.esm.json
commitlintcommitlint --edit
compiletsc -p tsconfig.esm.json
compile:watchnpm run compile -- --watch
coveragenpm run test -- --coverage
fixnpm run lint -- --fix
fix-package-jsonecho '{"type":"commonjs"}' > build/cjs/package.json
linteslint --ext .ts,.js .
prepublishOnlynpm run build
releasesemantic-release
startnode build/src/index.js
testNODE_ENV=test jest --testPathIgnorePatterns=__tests__/modules/client/*
test-integrationNODE_ENV=test jest
test:watchnpm test -- --watch
update-cctp-protossh scripts/generate-cctp-protos.sh
webpackwebpack

Dependencies22

@cosmjs/amino^0.32.3
@cosmjs/crypto^0.32.4
@cosmjs/encoding^0.32.4
@cosmjs/math^0.32.4
@cosmjs/proto-signing^0.32.4
@cosmjs/stargate^0.32.4
@cosmjs/tendermint-rpc^0.32.4
@cosmjs/utils^0.32.4
@osmonauts/lcd^0.6.0
@ritbit/v4-proto^2.1.0
@scure/bip32^1.1.5
@scure/bip39^1.1.1
axios1.1.3
bech32^1.1.4
bignumber.js^9.3.1
cosmjs-types^0.9.0
ethereum-cryptography^2.0.0
ethers^6.6.1
https-proxy-agent^7.0.6
long^5.3.2
protobufjs>=6.11.4
ws^8.14.2