PkgRadar

Package evidence

@zenbujs/[email protected]

Credential file access: matched "GITHUB_TOKEN"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@zenbujs/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@zenbujs/[email protected]"],"fail_on":"high"}'
Publisherrobpruzan
Artifact bytes795,185
Previous version0.0.24
Published2026-05-22T23:33:01.413Z
SHA-256879991137f4be37488a118e92cebae0fc297748012934c2cacf57f06d24859dd

Why flagged

What the scanner saw

Credential file access: matched "GITHUB_TOKEN"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
103Score
0.0.25Version
Status history (1 event)
  1. new → available · risk high · score 103 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

robpruzan

3 members · evidence strength 72

Evidence

Static findings

11 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential file accesspackage/dist/build-electron-DR3PyeR6.mjsmatched "GITHUB_TOKEN"30
highCredential file accesspackage/dist/publish-source-D3S-A6t_.mjsmatched "GITHUB_TOKEN"30
mediumRemote Payloadpackage/dist/build-electron-DR3PyeR6.mjsmatched "github.com/oven-sh/bun/releases/download"12
mediumLarge Javascript Payloadpackage/dist/transform-czrcGnVV.mjs2442011 bytes10
Show all 11 findings (low-signal and informational)
SeverityKindPathDetailPoints
highCredential file accesspackage/dist/build-electron-DR3PyeR6.mjsmatched "GITHUB_TOKEN"30
highCredential file accesspackage/dist/publish-source-D3S-A6t_.mjsmatched "GITHUB_TOKEN"30
mediumRemote Payloadpackage/dist/build-electron-DR3PyeR6.mjsmatched "github.com/oven-sh/bun/releases/download"12
mediumLarge Javascript Payloadpackage/dist/transform-czrcGnVV.mjs2442011 bytes10
lowObfuscationpackage/dist/advice-runtime.mjsmatched "\\u2014"3
lowObfuscationpackage/dist/cli-BQo9ScQB.mjsmatched "\\u001b"3
lowObfuscationpackage/dist/db-fL3IQxfq.mjsmatched "\\x1B"3
lowObfuscationpackage/dist/launcher.mjsmatched "eval("3
lowObfuscationpackage/dist/react.mjsmatched "atob("3
lowObfuscationpackage/dist/transport-CuGTygJV.mjsmatched "fromCharCode"3
lowObfuscationpackage/dist/vite-plugins-CDdb7ile.mjsmatched "atob("3

Manifest

Package metadata

Scripts7
  • buildnode --max-old-space-size=8192 ./node_modules/tsdown/dist/run.mjs
  • db:generatenode ./dist/cli/bin.mjs db generate --schema src/schema.ts --migrations ./migrations
  • devtsdown --watch
  • link:typestsx ./src/cli/bin.ts link --types-config ./zenbu-types.config.json --out ./src/registry-generated.ts --augment-out ./types/zenbu-register.ts
  • prebuildpnpm link:types
  • testvitest run
  • typechecktsc --noEmit -p tsconfig.json
Dependencies11
  • @parcel/watcher^2.5.0
  • @vitejs/plugin-react^5.0.0
  • @zenbujs/hmr0.0.2
  • effect^3.21.1
  • electron-context-menu^4.1.2
  • isomorphic-git^1.37.6
  • nanoid^5.1.6
  • semver^7.8.0
  • tsx4.19.4
  • vite^6.0.0
  • ws^8.18.0