Package evidence

@verdaccio/[email protected]

Credential file access: matched "NPM_TOKEN"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 460
Versions published: 31
First published: Apr 2026
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@verdaccio/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@verdaccio/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes258,815

Previous version6.7.2-canary.22dba02

Published2026-05-28T17:38:20.220Z

SHA-2560b431df1bd59e8938da6329bd914f1ab581d6a01ef17ae5694cbde9441992697

Why flagged

What the scanner saw

Credential file access: matched "NPM_TOKEN"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

15d agoLast checked

reviewRisk

1Score

6.7.2-canary.b319f7eVersion

Status history (1 event)

new → available15d ago · risk review · score 1 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Credential file access	package/build/lib/up-storage.js	matched "NPM_TOKEN"	5

Manifest

Package metadata

Scripts29

buildrm -Rf build && PACKAGE_VERSION=$(node -p "require('./package.json').version") yarn babel src/ --out-dir build/ --copy-files --extensions ".ts,.tsx" --source-maps inline
cache:cleanyarn cache clean --mirror && yarn cache clean --all
changesetchangeset
changeset:checkchangeset status --since=origin/6.x
ci:publishchangeset publish
ci:versionyarn ci:version:changeset && yarn install --no-immutable
ci:version:changesetchangeset version
code:docker-buildyarn babel src/ --out-dir build/ --copy-files --extensions ".ts,.tsx"
code:typestsc --emitDeclarationOnly -p tsconfig.json
dockerdocker build -t verdaccio/verdaccio:local . --no-cache
docker:rundocker run -it --rm -p 4873:4873 -e "DEBUG=verdaccio*" verdaccio/verdaccio:local
e2e:ui:local./scripts/e2e-ui-local.sh
e2e:ui:local:open./scripts/e2e-ui-local.sh --open
e2e:ui:opencypress open
e2e:ui:runcypress run
e2e:ui:startnode bin/verdaccio --config ./scripts/e2e-ui-config.yaml
formatprettier --write "**/*.{js,jsx,ts,tsx,json,yml,yaml,md}"
format:checkprettier --check "**/*.{js,jsx,ts,tsx,json,yml,yaml,md}"
linteslint "**/*.{js,jsx,ts}"
lint:lockfileecho 'No lockfile linting available'
lint:tsyarn run type-check
pre:ciyarn run lint
startyarn babel-node --extensions ".ts,.tsx" src/lib/cli --inspect
start:brkyarn babel-node --extensions ".ts,.tsx" src/lib/cli --inspect-brk
start:debugyarn node debug/bootstrap.js
start:run-serveryarn node debug/bootstrap-runserver.js
testcross-env NODE_ENV=test TZ=UTC FORCE_COLOR=1 vitest run
type-checktsc --noEmit
type-check:watchyarn run type-check -- --watch

Dependencies31

@cypress/request3.0.10
@verdaccio/auth8.0.2
@verdaccio/config8.1.1
@verdaccio/core8.1.1
@verdaccio/hooks8.0.2
@verdaccio/loaders8.0.2
@verdaccio/local-storage-legacy11.3.3
@verdaccio/logger8.0.2
@verdaccio/middleware8.0.2
@verdaccio/package-filter13.0.2
@verdaccio/search-indexer8.0.2
@verdaccio/signature8.0.2
@verdaccio/streams10.2.5
@verdaccio/tarball13.0.2
@verdaccio/ui-theme9.0.0-next-9.14
@verdaccio/url13.0.2
@verdaccio/utils8.1.2
JSONStream1.3.5
async3.2.6
clipanion4.0.0-rc.4
compression1.8.1
cors2.8.6
debug4.4.3
envinfo7.21.0
express4.22.2
lodash4.18.1
lru-cache7.18.3
mime3.0.0
semver7.8.0
verdaccio-audit13.0.2
…and 1 more.