PkgRadar

Package evidence

@sigmashake/[email protected]

Credential file access: matched "id_rsa"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,642Niche · −30% score
Versions published
271
First published
Apr 2026
Publisher
sigmashake-owner

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@sigmashake/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@sigmashake/[email protected]"],"fail_on":"review"}'
Publishersigmashake-owner
Artifact bytes390,117
Previous version0.29.155
Published2026-06-12T22:25:32.578Z
SHA-256e7f85fbc027cdc503e889e39072ba94c68f4cd89fb65ca23510d14e36d02c2cb

Why flagged

What the scanner saw

Credential file access: matched "id_rsa"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
7Score
0.29.158Version
Status history (1 event)
  1. new → available · risk review · score 7 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/public/assets/app.jsmatched "id_rsa"5
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node ./bin/cleanup-globals.cjs"5

Manifest

Package metadata

Scripts97
  • ai-native:latencybun run tools/ai-native-latency.ts
  • auditbun audit --prod
  • benchbun test ./test/bench.perf.ts --timeout=120000
  • bench:honestbun test ./test/native-coverage.perf.ts --timeout=180000
  • bench:regressionbun test ./test/bench-regression.perf.ts --timeout=300000
  • bench:scalingbun test ./test/bench-scaling.perf.ts --timeout=180000
  • buildbun run build:client && bun build --compile src/cli.ts --outfile ssg
  • build:allbun run build:linux && bun run build:linux-arm64 && bun run build:macos-arm64 && bun run build:macos-x64 && bun run build:windows && bun run build:windows-hookw
  • build:clienttsc --noEmit -p tsconfig.client.json && vite build
  • build:demo-recorderbun build --compile tools/demo-recorder/index.ts --outfile tools/demo-recorder/demo-recorder
  • build:docsbun build --compile tools/docs/index.ts --outfile tools/docs/docs
  • build:linuxbun build --compile --target=bun-linux-x64 src/cli.ts --outfile dist/ssg-linux-x64 && bun run scripts/stage-public-to-dist.ts
  • build:linux-arm64bun build --compile --target=bun-linux-arm64 src/cli.ts --outfile dist/ssg-linux-arm64 && bun run scripts/stage-public-to-dist.ts
  • build:lspbun build --compile tools/lsp/index.ts --outfile tools/lsp/ssg-lsp
  • build:macos-arm64bun build --compile --target=bun-darwin-arm64 src/cli.ts --outfile dist/ssg-darwin-arm64 && bun run scripts/stage-public-to-dist.ts
  • build:macos-universalbun run build:macos-arm64 && bun run build:macos-x64 && lipo -create dist/ssg-darwin-arm64 dist/ssg-darwin-x64 -output dist/ssg-darwin-universal && file dist/ssg-darwin-universal
  • build:macos-x64bun build --compile --target=bun-darwin-x64 src/cli.ts --outfile dist/ssg-darwin-x64 && bun run scripts/stage-public-to-dist.ts
  • build:nativebun run build:rust && cd native && bash ../../sigmashake-dist/scripts/power-gated.sh zig build -Doptimize=ReleaseFast
  • build:native:allbash ../sigmashake-dist/scripts/build-native-all.sh
  • build:native:darwin-arm64bash ../sigmashake-dist/scripts/build-native-target.sh darwin-arm64
  • build:native:darwin-x64bash ../sigmashake-dist/scripts/build-native-target.sh darwin-x64
  • build:native:docker:linux-arm64bash ../sigmashake-dist/scripts/build-native-target.sh linux-arm64-musl
  • build:native:docker:linux-x64bash ../sigmashake-dist/scripts/build-native-target.sh linux-x64-musl
  • build:native:linux-arm64bash ../sigmashake-dist/scripts/build-native-target.sh linux-arm64
  • build:native:linux-x64bash ../sigmashake-dist/scripts/build-native-target.sh linux-x64
  • build:native:windowsbash ../sigmashake-dist/scripts/build-native-target.sh win32-x64
  • build:oraclebun build --compile tools/oracle/index.ts --outfile tools/oracle/oracle
  • build:protected:allbash ../sigmashake-dist/scripts/build-protected.sh
  • build:rustcd native/rust && bash ../../../sigmashake-dist/scripts/power-gated.sh cargo build --release
  • build:toolsbun run build:demo-recorder && bun run build:docs && bun run build:lsp && bun run build:oracle
  • …and 67 more.
Optional dependencies5
  • @sigmashake/ssg-darwin-arm640.29.158
  • @sigmashake/ssg-darwin-x640.29.158
  • @sigmashake/ssg-linux-arm640.29.158
  • @sigmashake/ssg-linux-x640.29.158
  • @sigmashake/ssg-win32-x640.29.158