PkgRadar

Package evidence

[email protected]

Credential File Packaged: package/config/.env

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
267
Versions published
44
First published
Apr 2026
Publisher
aksika

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisheraksika
Artifact bytes29,645,316
Previous version0.2.3-alpha.0
Published2026-06-17T19:06:32.193Z
SHA-2567db76a82a5ada03906dc069f1f01b0d93b05b04a261ffce2fb178ea1e8995728

Why flagged

What the scanner saw

Credential File Packaged: package/config/.env

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
85Score
0.3.0-alpha.0Version
Status history (1 event)
  1. new → available · risk high · score 85 · status changed

Evidence

Static findings

109 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential File Packagedpackage/config/.envpackage/config/.env35
Show all 109 findings (low-signal and informational)

Showing 60 of 109 findings.

SeverityKindPathDetailPoints
highCredential File Packagedpackage/config/.envpackage/config/.env35
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-2LIYATUR.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-2U4XOAWS.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-3ASVKAXC.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-3TWYAK5L.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-3UNNZUY7.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-4MEWGWK4.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-4ZLZU4S4.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-5APMRJGS.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-5BQRICLY.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-5IBVKCID.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-5N7WF37E.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-5NARTCAF.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-5OAIPFRC.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-5Z5IQ4CJ.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-63QYPZ7P.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-67ACEVSB.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-7734PBCQ.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-7IYRYOF3.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-7SYRUMQ3.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-7ZJKXXZ5.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-AGJFTUDN.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-BDRN5DVH.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-BHQGBNSA.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-BWYGTNEQ.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-BY6FI74I.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-C6KINY2O.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-CLTIAJFZ.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-DFYJVWVQ.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-DOSFVNVW.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-E6OXYV22.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-EISDRSMC.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-ELXTJ5YO.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-EQSYOTIS.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-EUNOM5TK.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-F7VQGSTA.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-FFEGTAUB.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-FFMUBDQ2.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-FXLAFUVK.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-GGLPO4QC.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-GOMZJEMZ.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-GOYZ43NG.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-GRKNJCFE.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-H5LJCHQK.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-HCFQXENC.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-HH5M62S7.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-HYT5ESML.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-ICPMERHD.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-ISHMNQ46.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-IWBN6LGR.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-IWCFUNHW.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-IYMTCAHB.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-JULJ7E37.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-KODFNRCG.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-KRHYEATJ.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-KVYO42V5.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-KXOV4V3R.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-LD6MJXYZ.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-LX32ODE2.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5
lowMessenger Bot Endpointpackage/bundle/telegram-adapter-N5BIKFH4.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5

Manifest

Package metadata

Scripts10
  • buildtsc && rm -rf dist/components/dashboard/public && cp -r src/components/dashboard/public dist/components/dashboard/public && git log -1 --format='{"hash":"%h","date":"%ci"}' > dist/build-info.json
  • bundlerm -rf bundle && cd ../abmind && npm run build && cd ../abtars && node esbuild.config.js && rm -rf bundle/public && cp -r src/components/dashboard/public bundle/public && cp -r agents bundle/agents
  • check-importsbash -c '! grep -rE "from \"abmind/|from '\''abmind/" src --include=*.ts | grep -vE "abmind/deploy-lib\"|abmind/deploy-lib'\''"'
  • devnode --import tsx src/main.ts
  • prepublishOnlynode -e "const p=require('./package.json');const d=JSON.stringify(p.dependencies||{});if(d.includes('file:')){console.error('ERROR: file: dependency found');process.exit(1)}"
  • startnode dist/main.js
  • testvitest --run && node src/cli/commands/install-smoke.mjs
  • test:integrationvitest --run --dir src/tests/integration
  • test:watchvitest
  • typechecktsc --noEmit