PkgRadar

Package evidence

@sigmashake/[email protected]

Credential file access: matched ".ssh/"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,734Niche · −30% score
Versions published
267
First published
Apr 2026
Publisher
sigmashake-owner

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@sigmashake/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@sigmashake/[email protected]"],"fail_on":"review"}'
Publishersigmashake-owner
Artifact bytes364,042
Previous version0.29.150
Published2026-06-05T02:31:21.194Z
SHA-256c73fbcb8e231480ba3c4627e3c38d2ab22ce19939a5b98d82c20fd5208eb6410

Why flagged

What the scanner saw

Credential file access: matched ".ssh/"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
7Score
0.29.151Version
Status history (1 event)
  1. new → available · risk review · score 7 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/public/assets/app.jsmatched ".ssh/"5
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node ./bin/cleanup-globals.cjs"5

Manifest

Package metadata

Scripts107
  • ai-native:latencybun run tools/ai-native-latency.ts
  • auditbun audit --prod
  • benchbun test ./test/bench.perf.ts --timeout=120000
  • bench:honestbun test ./test/native-coverage.perf.ts --timeout=180000
  • bench:regressionbun test ./test/bench-regression.perf.ts --timeout=300000
  • bench:scalingbun test ./test/bench-scaling.perf.ts --timeout=180000
  • buildbun run build:client && bun build --compile src/cli.ts --outfile ssg
  • build:allbun run build:linux && bun run build:linux-arm64 && bun run build:macos-arm64 && bun run build:macos-x64 && bun run build:windows && bun run build:windows-hookw
  • build:clienttsc --noEmit -p tsconfig.client.json && vite build
  • build:demo-recorderbun build --compile tools/demo-recorder/index.ts --outfile tools/demo-recorder/demo-recorder
  • build:docsbun build --compile tools/docs/index.ts --outfile tools/docs/docs
  • build:linuxbun build --compile --target=bun-linux-x64 src/cli.ts --outfile dist/ssg-linux-x64 && bun run scripts/stage-public-to-dist.ts
  • build:linux-arm64bun build --compile --target=bun-linux-arm64 src/cli.ts --outfile dist/ssg-linux-arm64 && bun run scripts/stage-public-to-dist.ts
  • build:lspbun build --compile tools/lsp/index.ts --outfile tools/lsp/ssg-lsp
  • build:macos-arm64bun build --compile --target=bun-darwin-arm64 src/cli.ts --outfile dist/ssg-darwin-arm64 && bun run scripts/stage-public-to-dist.ts
  • build:macos-universalbun run build:macos-arm64 && bun run build:macos-x64 && lipo -create dist/ssg-darwin-arm64 dist/ssg-darwin-x64 -output dist/ssg-darwin-universal && file dist/ssg-darwin-universal
  • build:macos-x64bun build --compile --target=bun-darwin-x64 src/cli.ts --outfile dist/ssg-darwin-x64 && bun run scripts/stage-public-to-dist.ts
  • build:nativebun run build:rust && cd native && bash ../../sigmashake-dist/scripts/power-gated.sh zig build -Doptimize=ReleaseFast
  • build:native:allbash ../sigmashake-dist/scripts/build-native-all.sh
  • build:native:audit:allbun run build:native:audit:linux-x64 && bun run build:native:audit:linux-arm64 && bun run build:native:audit:darwin-arm64 && bun run build:native:audit:darwin-x64 && bun run build:native:audit:windows
  • build:native:audit:darwin-arm64cd native && mkdir -p zig-out/lib/darwin-arm64 && cd rust-audit && cargo zigbuild --release --bin ssg-audit-server --target aarch64-apple-darwin && cd .. && cp rust-audit/target/aarch64-apple-darwin/release/ssg-audit-server zig-out/lib/darwin-arm64/
  • build:native:audit:darwin-x64cd native && mkdir -p zig-out/lib/darwin-x64 && cd rust-audit && cargo zigbuild --release --bin ssg-audit-server --target x86_64-apple-darwin && cd .. && cp rust-audit/target/x86_64-apple-darwin/release/ssg-audit-server zig-out/lib/darwin-x64/
  • build:native:audit:linux-arm64cd native && mkdir -p zig-out/lib/linux-arm64 && cd rust-audit && cargo zigbuild --release --bin ssg-audit-server --target aarch64-unknown-linux-gnu && cd .. && cp rust-audit/target/aarch64-unknown-linux-gnu/release/ssg-audit-server zig-out/lib/linux-arm64/
  • build:native:audit:linux-x64cd native && mkdir -p zig-out/lib/linux-x64 && cd rust-audit && cargo zigbuild --release --bin ssg-audit-server --target x86_64-unknown-linux-gnu && cd .. && cp rust-audit/target/x86_64-unknown-linux-gnu/release/ssg-audit-server zig-out/lib/linux-x64/
  • build:native:audit:windowscd native && mkdir -p zig-out/lib/win32-x64 && cd rust-audit && cargo zigbuild --release --bin ssg-audit-server --target x86_64-pc-windows-gnu && cd .. && cp rust-audit/target/x86_64-pc-windows-gnu/release/ssg-audit-server.exe zig-out/lib/win32-x64/
  • build:native:darwin-arm64bash ../sigmashake-dist/scripts/build-native-target.sh darwin-arm64
  • build:native:darwin-x64bash ../sigmashake-dist/scripts/build-native-target.sh darwin-x64
  • build:native:linux-arm64bash ../sigmashake-dist/scripts/build-native-target.sh linux-arm64
  • build:native:linux-x64bash ../sigmashake-dist/scripts/build-native-target.sh linux-x64
  • build:native:windowsbash ../sigmashake-dist/scripts/build-native-target.sh win32-x64
  • …and 77 more.
Optional dependencies5
  • @sigmashake/ssg-darwin-arm640.29.143
  • @sigmashake/ssg-darwin-x640.29.143
  • @sigmashake/ssg-linux-arm640.29.151
  • @sigmashake/ssg-linux-x640.29.151
  • @sigmashake/ssg-win32-x640.29.148