PkgRadar

Package evidence

@tandem-language-exchange/[email protected]

Credential file access: matched "AWS_ACCESS_KEY"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
59
First published
Apr 2026
Publisher
markmulder

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@tandem-language-exchange/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@tandem-language-exchange/[email protected]"],"fail_on":"review"}'
Publishermarkmulder
Artifact bytes92,065
Previous version1.3.6
Published2026-05-28T11:38:21.312Z
SHA-25606bd455e318c9e32893509d90b545e5def80fff8456a60fe83d8e6d488137004

Why flagged

What the scanner saw

Credential file access: matched "AWS_ACCESS_KEY"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
5Score
1.3.7Version
Status history (2 events)
  1. new → available · risk review · score 5 · status changed
  2. new → available · risk review · score 5 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/dist/chunk-OCAIIQZW.jsmatched "AWS_ACCESS_KEY"5

Manifest

Package metadata

Scripts18
  • buildtsup
  • build:dockerdocker build --build-arg LOCAL_BUILD=true -f ./deploy/Dockerfile -t web-content-store .
  • devtsx watch src/server/cli.ts serve
  • fetch:content-bundlestsx src/client/fetch-content-bundles.ts
  • fetch:merged-translationstsx src/client/fetch-merged-translation-bundles.ts
  • fetch:translationstsx src/client/fetch-translation-bundles.ts
  • linteslint .
  • lint:fixeslint --fix .
  • list:projectstsx src/client/list-projects.ts
  • list:resourcestsx src/client/list-resources.ts
  • query:cmstsx src/client/query-cms.ts
  • startnode dist/server/cli.js serve
  • sync-appconfig:localsync-appconfig env=local project=web-content-store
  • sync-appconfig:productionsync-appconfig env=production project=web-content-store
  • sync-appconfig:stagingsync-appconfig env=staging project=web-content-store
  • sync:contentfultsx src/server/cli.ts sync-cms-content --cms contentful
  • sync:sanitytsx src/server/cli.ts sync-cms-content --cms sanity
  • sync:translationstsx src/server/cli.ts sync-translations --projects=
Dependencies13
  • @aws-sdk/client-s3^3.700.0
  • @sanity/client^7.20.0
  • @slack/bolt^4.7.0
  • commander^13.1.0
  • contentful11.10.3
  • dotenv16.4.5
  • eslint^10.2.0
  • express^5.1.0
  • globals^17.4.0
  • lodash.merge^4.6.2
  • nodemon^3.1.14
  • typescript-eslint^8.58.1
  • xml-js^1.6.11