PkgRadar

Package evidence

[email protected]

Credential File Packaged: package/config/.env

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
43
First published
Apr 2026
Publisher
aksika

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisheraksika
Artifact bytes5,607,558
Previous version0.1.0-alpha.26
Published2026-06-01T18:23:03.390Z
SHA-25600fad99d7490613952fcc649e0d3e2b1f014f6047066621078d5e60299f967ce

Why flagged

What the scanner saw

Credential File Packaged: package/config/.env

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
82Score
0.1.0-alpha.27Version
Status history (2 events)
  1. available → available · risk high · score 82 · status available -> available, risk high -> high, score 57 -> 82
  2. new → available · risk high · score 57 · status changed

Evidence

Static findings

13 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential File Packagedpackage/config/.envpackage/config/.env35
mediumRemote Payloadpackage/bundle/abtars-cli.jsmatched "api.telegram.org/bot"12
Show all 13 findings (low-signal and informational)
SeverityKindPathDetailPoints
highCredential File Packagedpackage/config/.envpackage/config/.env35
mediumRemote Payloadpackage/bundle/abtars-cli.jsmatched "api.telegram.org/bot"12
lowMessenger Bot Endpointpackage/bundle/abtars-cli.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-F2OS2FAM.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-FS6WU2HS.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-ISQRW7PN.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-QCD7AG5D.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-Y3PVA25S.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-YAXSK2RT.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowLarge Javascript Payloadpackage/bundle/chunk-P6PN34XD.js2976873 bytes0
lowObfuscation Densitypackage/bundle/chunk-RV54J75Q.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/bundle/chunk-WX7GHGFX.jshigh encoded/escaped-token density0
lowLarge Javascript Payloadpackage/bundle/esm-PFOJARXA.js3226814 bytes0

Manifest

Package metadata

Scripts9
  • buildtsc && rm -rf dist/components/dashboard/public && cp -r src/components/dashboard/public dist/components/dashboard/public && git log -1 --format='{"hash":"%h","date":"%ci"}' > dist/build-info.json
  • bundlerm -rf bundle && cd ../abmind && npm run build && cd ../abtars && node esbuild.config.js && rm -rf bundle/public && cp -r src/components/dashboard/public bundle/public && cp -r agents bundle/agents
  • check-importsbash -c '! grep -rE "from \"abmind/|from '\''abmind/" src --include=*.ts | grep -vE "abmind/deploy-lib\"|abmind/deploy-lib'\''"'
  • devnode --import tsx src/main.ts
  • prepublishOnlynode -e "const p=require('./package.json');const d=JSON.stringify(p.dependencies||{});if(d.includes('file:')){console.error('ERROR: file: dependency found');process.exit(1)}"
  • startnode dist/main.js
  • testvitest --run
  • test:watchvitest
  • typechecktsc --noEmit