Package evidence

@woosmap/[email protected]

Credential File Packaged: package/.env

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 459
Versions published: 1,223Mature · −50% score
First published: Feb 2021
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@woosmap/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@woosmap/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes4,679,296

Previous version4.251.8

Published2026-03-25T13:12:13.490Z

SHA-2563d548681bbd4b6dc101a3a9ebb14149e3d9330b6c320780e68d4bb7c547cdd85

Why flagged

What the scanner saw

Credential File Packaged: package/.env

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

12d agoLast checked

reviewRisk

10Score

4.251.9Version

Status history (1 event)

new → available12d ago · risk review · score 10 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Credential File Packaged	package/.env	package/.env	35

Manifest

Package metadata

Scripts20

buildrimraf dist && NODE_ENV=production babel src --out-dir dist --copy-files --no-copy-ignored --ignore '**/*.stories.js,**/*.test.js,**/*.styl' && yarn build-css
build-cssstylus ./src/styles/style-console.styl -o dist && stylus ./src/styles/style-stories.styl -o dist
build-storybookstorybook build -s public
coveragereact-scripts test --coverage --silent --ci --coverageReporters=text --coverageReporters=text-summary --watchAll=false --collectCoverageFrom=!src/**/*.stories.js --collectCoverageFrom=!src/**/*.json
deploy-storybookstorybook-to-ghpages
extractbabel -f .babelrc 'src/components/**/*.{js,jsx,ts,tsx}'
formatprettier --write "src/**/*.{js,jsx,ts,tsx,json,css,md}"
format:checkprettier --check "src/**/*.{js,jsx,ts,tsx,json,css,md}"
iconssvgo -f ./src/icons --config ./svgo-config.js
linteslint src --ext .js,.jsx --fix
lint:checkeslint src --ext .js,.jsx
prestorybook:devclear && echo "DOING FIRST TEST RUN" && CI=true npm run test:generate-output
publish-npmyarn version --minor && npm publish --access=public
startyarn stylus-dev && yarn storybook:dev
storybookstorybook dev -p 9009 public -h localhost
storybook:devclear && concurrently -k "npm run storybook" "npm run test:generate-output"
stylusstylus ./src/styles/style-console.styl -o dist/styles/dev
stylus-devstylus ./src/styles/style-console.styl -o dist/styles/dev && stylus ./src/styles/style-stories.styl -o dist/styles/dev
testreact-scripts test
test:generate-outputreact-scripts test --json --outputFile=./.storybook/jest-test-results.json --silent

Dependencies19

@mapbox/polyline^1.2.1
axios0.28.1
classnames^2.5.1
framer-motion^11.3.28
google-map-react^2.2.1
i18next^23.14.0
moment^2.30.1
numeral^2.0.6
perfect-scrollbar^1.5.5
prop-types^15.8.1
react^18.3.1
react-datetime^3.2.0
react-dom^18.3.1
react-laag^2.0.5
react-select^5.10.0
react-slider^2.0.6
react-syntax-highlighter^15.5.0
resize-observer-polyfill^1.5.1
zxcvbn^4.4.2