Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Versions published
- 119
- First published
- Mar 2026
- Publisher
- GitHub ActionsTrusted automation · −70% score
Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@squadbase/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@squadbase/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Credential file access: matched "AWS_ACCESS_KEY"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 1 · status changed
Evidence
Static findings
73 static · 0 from release diff · showing high-signal first.
No high-signal findings — see all findings below.
Show all 73 findings (low-signal and informational)
Showing 60 of 73 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| low | Credential file access | package/dist/connectors/aws-billing.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Obfuscation Density | package/dist/connectors/airtable-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/airtable.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/amplitude.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/asana.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/attio.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/aws-billing.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/azure-sql.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/backlog-api-key.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/clickup.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/cosmosdb.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/customerio.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/dbt.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/freshdesk.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/freshsales.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/freshservice.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/gamma.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/github.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/gmail-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/gmail.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/google-ads.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/google-analytics-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/google-analytics.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/google-audit-log.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/google-calendar-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/google-calendar.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/google-docs.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/google-drive.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/google-search-console-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/google-sheets.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/google-slides.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/grafana.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/hubspot-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/hubspot.js | high encoded/escaped-token density | 0 |
| low | Large Javascript Payload | package/dist/cli/index.js | 2154826 bytes | 0 |
| low | Large Javascript Payload | package/dist/index.js | 2178001 bytes | 0 |
| low | Obfuscation Density | package/dist/connectors/influxdb.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/intercom-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/intercom.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/jdbc.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/jira-api-key.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/kintone-api-token.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/kintone.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/linear.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/linkedin-ads.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/mailchimp-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/mailchimp.js | high encoded/escaped-token density | 0 |
| low | Large Javascript Payload | package/dist/main.js | 2166703 bytes | 0 |
| low | Obfuscation Density | package/dist/connectors/meta-ads-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/meta-ads.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/mixpanel.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/monday.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/mongodb.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/notion-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/notion.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/oracle.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/outlook-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/powerbi-oauth.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/salesforce.js | high encoded/escaped-token density | 0 |
| low | Obfuscation Density | package/dist/connectors/semrush.js | high encoded/escaped-token density | 0 |
Manifest
Package metadata
Scripts4
buildtsup && npm run build:clibuild:clitsup src/cli/index.ts --out-dir dist/cli --format esm --platform node --no-splitting --external pg --external snowflake-sdk --external @google-cloud/bigquery --external mysql2 --external mssql --external oracledb --external ssh2 --external mongodb --external @azure/cosmos --external @aws-sdk/client-athena --external @aws-sdk/client-cost-explorer --external @aws-sdk/client-redshift-data --external @databricks/sql --external @clickhouse/client --external @google-analytics/data --external @kintone/rest-api-client --external hono --external @clack/promptsclitsx src/cli/index.tstype-checktsc
Dependencies22
@aws-sdk/client-athena^3.750.0@aws-sdk/client-cost-explorer^3.750.0@aws-sdk/client-redshift-data^3.750.0@azure/cosmos^4.9.3@clickhouse/client^1.18.2@databricks/sql^1.8.0@google-analytics/data^4.8.0@google-cloud/bigquery^7.9.4@hono/node-server^1.19.9@hono/vite-build^1.10.0@hono/vite-dev-server^0.25.0@kintone/rest-api-client^5.5.0google-auth-library^9.15.1hono^4.11.9mongodb^7.1.1mssql^11.0.1mysql2^3.11.0oracledb^6.6.0pg^8.18.0snowflake-sdk^1.15.0ssh2^1.16.0zod^4.3.6