PkgRadar

Package evidence

[email protected]

Credential File Packaged: package/config/.env

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
3,557Niche · −30% score
Versions published
43
First published
Apr 2026
Publisher
aksika

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisheraksika
Artifact bytes2,910,681
Previous version0.1.0-alpha.28
Published2026-06-02T16:27:28.515Z
SHA-256d04118c61413bbd1e38f27c0c622179757c7b2fd487b392701655a3adef64252

Why flagged

What the scanner saw

Credential File Packaged: package/config/.env

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
28Score
0.2.0Version
Status history (3 events)
  1. available → available · risk high · score 28 · status available -> available, risk high -> high, score 40 -> 28
  2. available → available · risk high · score 40 · status available -> available, risk high -> high, score 28 -> 40
  3. new → available · risk high · score 28 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential File Packagedpackage/config/.envpackage/config/.env35
Show all 4 findings (low-signal and informational)
SeverityKindPathDetailPoints
highCredential File Packagedpackage/config/.envpackage/config/.env35
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-MVA33IO2.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowLarge Javascript Payloadpackage/bundle/chunk-P6PN34XD.js2976873 bytes0
lowObfuscation Densitypackage/bundle/chunk-RV54J75Q.jshigh encoded/escaped-token density0

Manifest

Package metadata

Scripts9
  • buildtsc && rm -rf dist/components/dashboard/public && cp -r src/components/dashboard/public dist/components/dashboard/public && git log -1 --format='{"hash":"%h","date":"%ci"}' > dist/build-info.json
  • bundlerm -rf bundle && cd ../abmind && npm run build && cd ../abtars && node esbuild.config.js && rm -rf bundle/public && cp -r src/components/dashboard/public bundle/public && cp -r agents bundle/agents
  • check-importsbash -c '! grep -rE "from \"abmind/|from '\''abmind/" src --include=*.ts | grep -vE "abmind/deploy-lib\"|abmind/deploy-lib'\''"'
  • devnode --import tsx src/main.ts
  • prepublishOnlynode -e "const p=require('./package.json');const d=JSON.stringify(p.dependencies||{});if(d.includes('file:')){console.error('ERROR: file: dependency found');process.exit(1)}"
  • startnode dist/main.js
  • testvitest --run
  • test:watchvitest
  • typechecktsc --noEmit