Package evidence

@taimos/[email protected]

Credential file access: matched ".aws"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@taimos/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@taimos/[email protected]"],"fail_on":"high"}'

PublisherGitHub Actions

Artifact bytes174,366

Previous version0.1.57

Published2026-05-18T00:58:29.003Z

SHA-256656e94e3531a1b644dea3376dd3e0aa06635d68abbe58a12606c262280ddd30e

Why flagged

What the scanner saw

Credential file access: matched ".aws"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

19d agoLast checked

highRisk

90Score

0.1.58Version

Status history (1 event)

new → available19d ago · risk high · score 90 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Credential file access	package/lib/projects/cdk-app.js	matched ".aws"	30
high	Credential file access	package/lib/projects/cdk-construct.js	matched ".aws"	30
high	Credential file access	package/lib/projects/ts-lib.js	matched "GITHUB_TOKEN"	30

Manifest

Package metadata

Scripts22

buildnpx projen build
bumpnpx projen bump
clobbernpx projen clobber
compatnpx projen compat
compilenpx projen compile
defaultnpx projen default
docgennpx projen docgen
ejectnpx projen eject
eslintnpx projen eslint
packagenpx projen package
package-allnpx projen package-all
package:jsnpx projen package:js
post-compilenpx projen post-compile
post-upgradenpx projen post-upgrade
pre-compilenpx projen pre-compile
projennpx projen
releasenpx projen release
testnpx projen test
test:watchnpx projen test:watch
unbumpnpx projen unbump
upgradenpx projen upgrade
watchnpx projen watch