PkgRadar

Package evidence

@sap/[email protected]

Credential file access: matched "GITHUB_TOKEN"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
51,544Mainstream · −50% score
Versions published
680Mature · −50% score
First published
Jun 2020
Publisher
sap_extncrepos

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@sap/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@sap/[email protected]"],"fail_on":"review"}'
Publishersap_extncrepos
Artifact bytes2,587,570
Previous version1.71.154
Published2026-05-26T14:07:02.778Z
SHA-25658058a133079ef688832015bcc9873632812e98e58bd81f94a0dd304cdf722e5

Why flagged

What the scanner saw

Credential file access: matched "GITHUB_TOKEN"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
1Score
1.71.155Version
Status history (1 event)
  1. new → available · risk review · score 1 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/dist/specification/scripts/distTagWriter.jsmatched "GITHUB_TOKEN"5

Manifest

Package metadata

Scripts29
  • buildnpm-run-all -l -s clean:before -s compile -p create-json-schemas copy-templates -p copy-json-schemas htmlV2 -s bundle
  • build:devnpm-run-all -l -s clean:before -s compile -p create-json-schemas copy-templates -s copy-json-schemas bundle:dev
  • build:docnpm-run-all -l -s clean:doc -s compile -s htmlV2 -s bundle
  • build:schemasnpm-run-all -l -s create-json-schemas copy-json-schemas
  • build:snapyarn build:dev && yarn update-snapshots
  • bundlenode esbuild
  • bundle:devnode esbuild --minify=false
  • bundle:watchnode esbuild --watch --stats --minify=false
  • clean:beforerimraf ./dist ./types ./schemas
  • clean:docrimraf ./dist/documentation
  • compiletsc --project ./tsconfig.build.json
  • compile:watchtsc --build ./tsconfig.build.json --pretty --watch
  • copy-json-schemascpy "schemas/**" dist/schemas
  • copy-templatescpy "src/sync/v2/export/templates/**" dist/templates --flat
  • create-json-schemasts-node ./scripts/schema/index.ts
  • deleteSnapshotsrimraf **/_file_snapshots_
  • docuV2ts-node ./scripts/extractDocu.ts --version=v2 format=excel
  • htmlV2ts-node ./scripts/extractDocu.ts --version=v2 --format=html
  • linteslint .
  • lint:fixeslint . --fix
  • lint:reporteslint . -f multiple
  • lint:report:jslinteslint . -o reports/lint/eslint.jslint.xml -f jslint-xml
  • lint:summaryeslint . -f summary
  • testjest && node ../../scripts/scov.js reports/test/unit/coverage/lcov.info
  • test:cinode --max-old-space-size=4096 ./node_modules/.bin/jest --ci --forceExit --detectOpenHandles && node ../../scripts/scov.js reports/test/unit/coverage/lcov.info
  • update-snapshotsjest --updateSnapshot
  • validity-reportts-node ./scripts/generate-validity-report.ts
  • watchnpm-run-all -l -s clean:before -p compile create-json-schemas copy-templates -p copy-json-schemas -s bundle:watch
  • watch:docnpm-run-all -l -s clean:doc -s compile -s htmlV2 -s bundle:watch
Dependencies2
  • @sap-ux/fe-fpm-writer0.43.28
  • @sap-ux/vocabularies-types0.15.0