Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@tyvm/[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@tyvm/[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Credential file access: matched "GITHUB_TOKEN"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 366 · status changed
Related candidates
Linked campaigns and clusters
micahriggan
3 members · evidence strength 74Evidence
Static findings
35 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/ts_build/src/clients/copilot.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/ts_build/src/clients/github.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/ts_build/src/clients/index.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/ts_build/src/chat/modules/SetupModule.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/tests/manual/cli/no-env.sh | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/src/clients/copilot.ts | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/src/clients/github.ts | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/src/clients/index.ts | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/src/chat/modules/SetupModule.ts | matched "GITHUB_TOKEN" | 30 |
| medium | Remote Payload | package/ts_build/src/services/DockerService.js | matched "curl " | 12 |
| medium | Remote Payload | package/src/services/DockerService.ts | matched "curl " | 12 |
Show all 35 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/ts_build/src/clients/copilot.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/ts_build/src/clients/github.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/ts_build/src/clients/index.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/ts_build/src/chat/modules/SetupModule.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/tests/manual/cli/no-env.sh | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/src/clients/copilot.ts | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/src/clients/github.ts | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/src/clients/index.ts | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/src/chat/modules/SetupModule.ts | matched "GITHUB_TOKEN" | 30 |
| medium | Remote Payload | package/ts_build/src/services/DockerService.js | matched "curl " | 12 |
| medium | Remote Payload | package/src/services/DockerService.ts | matched "curl " | 12 |
| low | Obfuscation | package/ts_build/src/processors/Base64ImageDetector.js | matched "atob(" | 3 |
| low | Obfuscation | package/ts_build/tests/processors/Base64ImageDetector.test.js | matched "Buffer.from(\"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==\", \"base64" | 3 |
| low | Obfuscation | package/ts_build/src/auth/browserLogin.js | matched "Buffer.from(parts[0], \"base64" | 3 |
| low | Obfuscation | package/ts_build/src/agents/tools/ycmd/client.js | matched "Buffer.from(this.serverInfo.hmacSecret, \"base64" | 3 |
| low | Obfuscation | package/ts_build/src/chat/renderer/CompactRenderer.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/ts_build/src/chat/renderer/FancyRenderer.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/ts_build/src/clients/gemini.js | matched "Buffer.from(audioPart.inlineData.data, \"base64" | 3 |
| low | Obfuscation | package/ts_build/tests/manual/modalities/google.modalities.test.js | matched "Buffer.from(imageData.b64_json, \"base64" | 3 |
| low | Obfuscation | package/ts_build/src/clients/knowhow.js | matched "Buffer.from(data.audio, \"base64" | 3 |
| low | Obfuscation | package/ts_build/tests/manual/modalities/openai.modalities.test.js | matched "Buffer.from(imageData.b64_json, \"base64" | 3 |
| low | Obfuscation | package/ts_build/src/workers/auth/WorkerPasskeyAuth.js | matched "Buffer.from(params.clientDataJSON, \"base64" | 3 |
| low | Obfuscation | package/ts_build/tests/manual/modalities/xai.modalities.test.js | matched "Buffer.from(imageData.b64_json, \"base64" | 3 |
| low | Obfuscation | package/tests/processors/Base64ImageDetector.test.ts | matched "Buffer.from(\n \"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==\",\n \"base64" | 3 |
| low | Obfuscation | package/src/processors/Base64ImageDetector.ts | matched "atob(" | 3 |
| low | Obfuscation | package/src/auth/browserLogin.ts | matched "Buffer.from(parts[0], \"base64" | 3 |
| low | Obfuscation | package/src/agents/tools/ycmd/client.ts | matched "Buffer.from(this.serverInfo.hmacSecret, \"base64" | 3 |
| low | Obfuscation | package/src/chat/renderer/CompactRenderer.ts | matched "\\x1b" | 3 |
| low | Obfuscation | package/src/chat/renderer/FancyRenderer.ts | matched "\\x1b" | 3 |
| low | Obfuscation | package/src/clients/gemini.ts | matched "Buffer.from(audioPart.inlineData.data, \"base64" | 3 |
| low | Obfuscation | package/tests/manual/modalities/google.modalities.test.ts | matched "Buffer.from(imageData.b64_json, \"base64" | 3 |
| low | Obfuscation | package/src/clients/knowhow.ts | matched "Buffer.from(data.audio, \"base64" | 3 |
| low | Obfuscation | package/tests/manual/modalities/openai.modalities.test.ts | matched "Buffer.from(imageData.b64_json, \"base64" | 3 |
| low | Obfuscation | package/src/workers/auth/WorkerPasskeyAuth.ts | matched "Buffer.from(params.clientDataJSON, \"base64" | 3 |
| low | Obfuscation | package/tests/manual/modalities/xai.modalities.test.ts | matched "Buffer.from(imageData.b64_json, \"base64" | 3 |
Manifest
Package metadata
Scripts21
buildnpm run compilecheck:isolatedbash scripts/check-isolated-deps.shcheck:model-pricingts-node scripts/check-model-pricing.tscleanrm -rf ts_buildcompilenpm run clean && tscdataset:diffs:generatets-node src/dataset/diffs/generate.tsdataset:diffs:jsonlts-node src/dataset/diffs/jsonl.tslinttslint ./src/**/*.tslint:allnpm run lint && npm run lint:depslint:depsdepcheck --config=.depcheckrcnode:buildbash scripts/build-for-node.shprepublishOnlynpm run compile && bash scripts/check-isolated-deps.shpublish:devbash scripts/publish.sh devpublish:latestbash scripts/publish.sh stablepublish:nightlybash scripts/publish.sh nightlypublish:stablebash scripts/publish.sh stablestartnpm run compile && node --no-node-snapshot ts_build/src/server/index.jstestjest --testTimeout 300000test:debugnode --inspect-brk ../../node_modules/jest/bin/jest.js --detectOpenHandles --forceExit --testTimeout 300000version:devbash scripts/publish.sh version:devversion:nightlybash scripts/publish.sh version:nightly
Dependencies20
@anthropic-ai/sdk^0.39.0@google/genai^0.14.1@inquirer/editor^4.2.18@modelcontextprotocol/sdk^1.13.3@simplewebauthn/server^13.3.0@tyvm/knowhow-tunnel0.0.5commander^14.0.0diff^5.2.0express^4.19.2gitignore-to-glob^0.3.0glob11.1.0jiti^2.6.1marked^10.0.0marked-terminal^6.2.0minimatch^10.1.2node-jq^6.0.1openai4.89.1pdf-parse^1.1.1ws^8.18.1zod^3.25.0
Optional dependencies1
esbuild-register^3.0.0