Package evidence

@smmachine/[email protected]

Credential File Packaged: package/apps/webapp/.next/standalone/apps/webapp/.env

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@smmachine/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@smmachine/[email protected]"],"fail_on":"high"}'

PublisherGitHub Actions

Artifact bytes16,652,418

Previous version0.0.2

Published2026-05-17T13:35:10.835Z

SHA-256669e165bd6a4431587da5928d09b634b31244307c08b01a6bc7a9b395b2439ec

Why flagged

What the scanner saw

Credential File Packaged: package/apps/webapp/.next/standalone/apps/webapp/.env

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

20d agoLast checked

highRisk

560Score

0.3.0Version

Status history (1 event)

new → available20d ago · risk high · score 560 · status changed

Related candidates

Linked campaigns and clusters

Repeated static TTPstale

Credential File Packaged — package/apps/webapp/.next/standalone/apps/webapp/.env

2 members · evidence strength 70

Evidence

Static findings

92 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Credential File Packaged	package/apps/webapp/.next/standalone/apps/webapp/.env	package/apps/webapp/.next/standalone/apps/webapp/.env	35
high	Credential file access	package/dist/index.cjs	matched "github_token"	30
high	Credential file access	package/dist/rest/main.cjs	matched "github_token"	30
high	Credential file access	package/apps/webapp/.next/server/chunks/ssr/[root-of-the-server]__0tdz~ex._.js	matched "github_token"	30
high	Credential file access	package/apps/webapp/.next/standalone/apps/webapp/.next/server/chunks/ssr/[root-of-the-server]__0tdz~ex._.js	matched "github_token"	30
medium	Obfuscation Density	package/dist/rest/main.cjs	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/next-server/app-page-turbo-experimental.runtime.prod.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/next-server/app-page-turbo.runtime.prod.js	high encoded/escaped-token density	12
medium	Remote Payload	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/client/components/segment-cache/cache.js	matched "cUrl "	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/comment-json/index.js	high encoded/escaped-token density	12
medium	Remote Payload	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/conf/index.js	matched "raw.githubusercontent.com"	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/conf/index.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/jsonwebtoken/index.js	high encoded/escaped-token density	12
medium	Remote Payload	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js	matched "cURL "	12
medium	Remote Payload	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/lib/mkcert.js	matched "github.com/FiloSottile/mkcert/releases/download"	12
medium	Obfuscation Density	package/apps/webapp/.next/build/chunks/node_modules__pnpm_12e~_lr._.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected][email protected]/node_modules/react-dom/cjs/react-dom-server-legacy.browser.production.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected][email protected]/node_modules/react-dom/cjs/react-dom-server-legacy.node.production.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected][email protected]/node_modules/react-dom/cjs/react-dom-server.browser.production.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected][email protected]/node_modules/react-dom/cjs/react-dom-server.edge.production.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected][email protected]/node_modules/react-dom/cjs/react-dom-server.node.production.js	high encoded/escaped-token density	12

Show all 92 findings (low-signal and informational)

Showing 60 of 92 findings.

Severity	Kind	Path	Detail	Points
high	Credential File Packaged	package/apps/webapp/.next/standalone/apps/webapp/.env	package/apps/webapp/.next/standalone/apps/webapp/.env	35
high	Credential file access	package/dist/index.cjs	matched "github_token"	30
high	Credential file access	package/dist/rest/main.cjs	matched "github_token"	30
high	Credential file access	package/apps/webapp/.next/server/chunks/ssr/[root-of-the-server]__0tdz~ex._.js	matched "github_token"	30
high	Credential file access	package/apps/webapp/.next/standalone/apps/webapp/.next/server/chunks/ssr/[root-of-the-server]__0tdz~ex._.js	matched "github_token"	30
medium	Obfuscation Density	package/dist/rest/main.cjs	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/next-server/app-page-turbo-experimental.runtime.prod.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/next-server/app-page-turbo.runtime.prod.js	high encoded/escaped-token density	12
medium	Remote Payload	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/client/components/segment-cache/cache.js	matched "cUrl "	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/comment-json/index.js	high encoded/escaped-token density	12
medium	Remote Payload	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/conf/index.js	matched "raw.githubusercontent.com"	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/conf/index.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/jsonwebtoken/index.js	high encoded/escaped-token density	12
medium	Remote Payload	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js	matched "cURL "	12
medium	Remote Payload	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/lib/mkcert.js	matched "github.com/FiloSottile/mkcert/releases/download"	12
medium	Obfuscation Density	package/apps/webapp/.next/build/chunks/node_modules__pnpm_12e~_lr._.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected][email protected]/node_modules/react-dom/cjs/react-dom-server-legacy.browser.production.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected][email protected]/node_modules/react-dom/cjs/react-dom-server-legacy.node.production.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected][email protected]/node_modules/react-dom/cjs/react-dom-server.browser.production.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected][email protected]/node_modules/react-dom/cjs/react-dom-server.edge.production.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected][email protected]/node_modules/react-dom/cjs/react-dom-server.node.production.js	high encoded/escaped-token density	12
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/zod/index.cjs	matched "atob("	3
low	Obfuscation	package/dist/index.cjs	matched "\\x1b"	3
low	Obfuscation	package/dist/rest/main.cjs	matched "eval("	3
low	Obfuscation	package/apps/webapp/.next/server/chunks/ssr/_0m.-wbb._.js	matched "\\u200e"	3
low	Obfuscation	package/apps/webapp/.next/standalone/apps/webapp/.next/server/chunks/ssr/_0m.-wbb._.js	matched "\\u200e"	3
low	Obfuscation	package/apps/webapp/.next/server/chunks/ssr/[root-of-the-server]__08sib~h._.js	matched "\\u0009"	3
low	Obfuscation	package/apps/webapp/.next/standalone/apps/webapp/.next/server/chunks/ssr/[root-of-the-server]__08sib~h._.js	matched "\\u0009"	3
low	Obfuscation	package/apps/webapp/.next/server/chunks/[root-of-the-server]__0p3s5md._.js	matched "\\u0009"	3
low	Obfuscation	package/apps/webapp/.next/standalone/apps/webapp/.next/server/chunks/[root-of-the-server]__0p3s5md._.js	matched "\\u0009"	3
low	Obfuscation	package/apps/webapp/.next/server/chunks/ssr/[root-of-the-server]__0tdz~ex._.js	matched "\\x1b"	3
low	Obfuscation	package/apps/webapp/.next/standalone/apps/webapp/.next/server/chunks/ssr/[root-of-the-server]__0tdz~ex._.js	matched "\\x1b"	3
low	Obfuscation	package/apps/webapp/.next/static/chunks/00.yzanihsvlg.js	matched "\\u200d"	3
low	Obfuscation	package/apps/webapp/.next/static/chunks/01p2dautq2ac2.js	matched "\\u0000"	3
low	Obfuscation	package/apps/webapp/.next/static/chunks/03~yq9q893hmn.js	matched "\\u2028"	3
low	Obfuscation	package/apps/webapp/.next/static/chunks/05_--2o_icxxw.js	matched "\\u00C0"	3
low	Obfuscation	package/apps/webapp/.next/server/chunks/ssr/05tt_next_dist_07-on~h._.js	matched "\\x1b"	3
low	Obfuscation	package/apps/webapp/.next/standalone/apps/webapp/.next/server/chunks/ssr/05tt_next_dist_07-on~h._.js	matched "\\x1b"	3
low	Obfuscation	package/apps/webapp/.next/server/chunks/ssr/05tt_next_dist_0c.hhwp._.js	matched "fromCharCode"	3
low	Obfuscation	package/apps/webapp/.next/standalone/apps/webapp/.next/server/chunks/ssr/05tt_next_dist_0c.hhwp._.js	matched "fromCharCode"	3
low	Obfuscation	package/apps/webapp/.next/server/chunks/ssr/05tt_next_dist_0yxnbkd._.js	matched "\\u0000"	3
low	Obfuscation	package/apps/webapp/.next/standalone/apps/webapp/.next/server/chunks/ssr/05tt_next_dist_0yxnbkd._.js	matched "\\u0000"	3
low	Obfuscation	package/apps/webapp/.next/server/chunks/ssr/05tt_next_dist_10i1bjz._.js	matched "\\u0000"	3
low	Obfuscation	package/apps/webapp/.next/standalone/apps/webapp/.next/server/chunks/ssr/05tt_next_dist_10i1bjz._.js	matched "\\u0000"	3
low	Obfuscation	package/apps/webapp/.next/static/chunks/0kxu_5kwzoz2u.js	matched "\\u200e"	3
low	Obfuscation	package/apps/webapp/.next/static/chunks/12c_ov5nzbjhm.js	matched "fromCharCode"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/next-server/app-page-turbo-experimental.runtime.prod.js	matched "fromCharCode"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/next-server/app-page-turbo.runtime.prod.js	matched "fromCharCode"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/next-server/app-route-turbo.runtime.prod.js	matched "\\u0009"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/server/resume-data-cache/cache-store.js	matched "atob("	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/server/node-environment-extensions/console-dim.external.js	matched "\\x1b"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/server/node-environment-extensions/console-file.js	matched "\\u001b"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/server/app-render/encryption-utils.js	matched "fromCharCode"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/server/app-render/encryption.js	matched "atob("	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/server/node-environment-extensions/fast-set-immediate.external.js	matched "\\x1B"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/experimental/testmode/fetch.js	matched "Buffer.from(body, 'base64"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/server/htmlescape.js	matched "\\u0026"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/lib/metadata/generate/icon-mark.js	matched "\\xab"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/@[email protected]/node_modules/@next/env/dist/index.js	matched "Buffer.from(e,\"base64"	3
low	Obfuscation	package/apps/webapp/.next/standalone/node_modules/.pnpm/[email protected]_@[email protected][email protected][email protected][email protected][email protected]/node_modules/next/dist/compiled/@hapi/accept/index.js	matched "\\u2028"	3

Manifest

Package metadata

Scripts11

buildpnpm run -r build
build:npmpnpm run -r clean && pnpm --filter @smmachine/utils build && pnpm --filter @smmachine/core build && pnpm --filter @smmachine/rest build && pnpm --filter @smmachine/webapp build && pnpm exec tsup
build:packagescd ./packages/utils && npm run build && cd ../core && npm run build
cleanpnpm run -r clean
clean:fullrm -rf node_modules && (cd apps/cli && rm -rf node_modules) && (cd apps/rest && rm -rf node_modules) && (cd apps/webapp && rm -rf node_modules) && (cd packages/core && rm -rf node_modules) && (cd packages/utils && rm -rf node_modules)
clicd ./apps/cli && pnpm run dev
devconcurrently "pnpm --filter=webapp run dev --port=3000" "PORT=8000 pnpm --filter=rest run dev"
lintpnpm run -r lint
testpnpm -r run test
typechecknpm run typecheck:packages
typecheck:packagescd ./packages/core && npm run type-check

Dependencies28

@emotion/cache^11.14.0
@emotion/react^11.14.0
@emotion/styled^11.14.1
@fontsource/roboto^5.2.10
@mui/icons-material^7.3.11
@mui/material^7.3.11
@mui/material-nextjs^7.3.10
@mui/x-date-pickers^8.28.5
@nestjs/common^10.4.22
@nestjs/core^10.4.22
@nestjs/platform-express^10.4.22
@nestjs/swagger^7.4.2
@radix-ui/react-slot^1.2.4
@radix-ui/react-tabs^1.1.13
class-transformer^0.5.1
class-validator^0.14.4
class-variance-authority^0.7.1
clsx^2.1.1
date-fns^4.1.0
dayjs^1.11.20
next16.2.1
react19.2.3
react-dom19.2.3
recharts^2.15.4
reflect-metadata^0.1.14
rxjs^7.8.2
swagger-ui-express^5.0.1
tailwind-merge^2.6.1