PkgRadar

Package evidence

@stainless-code/[email protected]

Credential file access: matched ".aws"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,825Niche · −30% score
Versions published
30
First published
Apr 2026
Publisher
sutusebastian

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@stainless-code/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@stainless-code/[email protected]"],"fail_on":"review"}'
Publishersutusebastian
Artifact bytes301,811
Previous version0.9.3
Published2026-05-27T16:55:27.695Z
SHA-2565ffda1583c290e0c3670fd49add5a5c17d6d7f4aca45487c6f2b795a9412c887

Why flagged

What the scanner saw

Credential file access: matched ".aws"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
3Score
0.9.4Version
Status history (1 event)
  1. new → available · risk review · score 3 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/dist/agents-init-BBuEZiOZ.mjsmatched ".aws"5

Manifest

Package metadata

Scripts31
  • benchmarkbun src/benchmark.ts
  • benchmark:querybun scripts/benchmark-query-output.ts
  • buildtsdown
  • changesetchangeset
  • checkbun run build && bun run --parallel format:check lint:ci test test:scripts typecheck && bun run test:golden && bun run test:agent-eval
  • check-updatesbun update -i --latest
  • check:perf-baselinebun scripts/check-perf-baseline.ts
  • check:perf-baseline:updatebun scripts/check-perf-baseline.ts --update
  • cleangit clean -xdf -e .env -e .codemap
  • devbun src/index.ts
  • fixbun run lint:fix && bun run format
  • formatoxfmt
  • format:checkoxfmt --check --no-error-on-unmatched-pattern
  • lintoxlint --no-error-on-unmatched-pattern
  • lint-stagedlint-staged
  • lint:cioxlint --quiet
  • lint:fixoxlint --fix
  • packbun run build && npm pack
  • preparehusky || true
  • prepublishOnlybun run check
  • qa:externalbun scripts/qa-external-repo.ts
  • releasechangeset publish
  • testbun test ./src
  • test:agent-evalbun test scripts/agent-eval
  • test:cibun run test:coverage
  • test:coveragebun test --coverage ./src
  • test:goldenbun scripts/query-golden.ts
  • test:golden:externalbun scripts/query-golden.ts --corpus external
  • test:scriptsbash -c 'files=$(find scripts -name "*.test.mjs"); if [ -z "$files" ]; then echo "no scripts test files found" >&2; exit 1; fi; exec bun test $files'
  • typechecktsgo --noEmit
  • …and 1 more.
Dependencies10
  • @clack/prompts1.4.0
  • @modelcontextprotocol/sdk1.29.0
  • better-sqlite312.10.0
  • chokidar5.0.0
  • lightningcss1.32.0
  • oxc-parser0.133.0
  • oxc-resolver11.19.1
  • package-manager-detector1.6.0
  • tinyglobby0.2.16
  • zod4.4.3