PkgRadar

Package evidence

[email protected]

Credential file access: matched ".AWS"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: 70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Artifact bytes1,825,029
Previous version8.5.3-alpha.f340933.0
Published2026-05-24T16:08:43.727Z
SHA-25612ec499e7a2b6f558df86cac35b2950f91726b00377ea71b3b51e50ce0d91215

Why flagged

What the scanner saw

Credential file access: matched ".AWS"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
532Score
8.5.3Version
Status history (1 event)
  1. newavailable · risk high · score 532 · status changed

Evidence

Static findings

58 static · 0 from release diff · showing high-signal first.

Showing 30 of 38 findings.

SeverityKindPathDetailPoints
highCredential file accesspackage/build/dist/chunk-7THP26YK.jsmatched ".AWS"30
mediumObfuscation Densitypackage/build/dist/chunk-2OVBIND4.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/build/dist/chunk-74A26AAT.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/build/dist/chunk-CPMWLSLU.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/build/dist/chunk-GZBCODHK.jshigh encoded/escaped-token density12
mediumRemote Payloadpackage/build/dist/chunk-OG54YGKQ.jsmatched "curl "12
mediumObfuscation Densitypackage/build/index.jshigh encoded/escaped-token density12
mediumRemote Payloadpackage/build/dist/assets/i18n/af-ZA.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ar-SA.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ca-ES.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/cs-CZ.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/da-DK.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/de-DE.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/default.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/el-GR.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/en-US.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/en.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/fi-FI.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/fr-FR.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/he-IL.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/hu-HU.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/it-IT.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ja-JP.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ko-KR.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/nl-NL.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/no-NO.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/pt-BR.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/pt-PT.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ro-RO.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ru-RU.jsonmatched "cURL "12
Show all 58 findings (low-signal and informational)
SeverityKindPathDetailPoints
highCredential file accesspackage/build/dist/chunk-7THP26YK.jsmatched ".AWS"30
mediumObfuscation Densitypackage/build/dist/chunk-2OVBIND4.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/build/dist/chunk-74A26AAT.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/build/dist/chunk-CPMWLSLU.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/build/dist/chunk-GZBCODHK.jshigh encoded/escaped-token density12
mediumRemote Payloadpackage/build/dist/chunk-OG54YGKQ.jsmatched "curl "12
mediumObfuscation Densitypackage/build/index.jshigh encoded/escaped-token density12
mediumRemote Payloadpackage/build/dist/assets/i18n/af-ZA.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ar-SA.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ca-ES.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/cs-CZ.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/da-DK.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/de-DE.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/default.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/el-GR.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/en-US.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/en.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/fi-FI.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/fr-FR.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/he-IL.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/hu-HU.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/it-IT.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ja-JP.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ko-KR.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/nl-NL.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/no-NO.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/pt-BR.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/pt-PT.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ro-RO.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/ru-RU.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/sr-SP.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/sv-SE.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/tr-TR.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/uk-UA.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/vi-VN.jsonmatched "cURL "12
mediumRemote Payloadpackage/build/dist/assets/i18n/zh-CN.jsonmatched "curl "12
mediumRemote Payloadpackage/build/dist/assets/i18n/zh-TW.jsonmatched "cURL "12
mediumLarge Javascript Payloadpackage/build/dist/main.js3069208 bytes10
lowObfuscationpackage/build/dist/chunk-2OVBIND4.jsmatched "fromCharCode"3
lowObfuscationpackage/build/dist/chunk-35VQWODI.jsmatched "\\u00B7"3
lowObfuscationpackage/build/dist/chunk-74A26AAT.jsmatched "atob("3
lowObfuscationpackage/build/dist/chunk-7THP26YK.jsmatched "fromCharCode"3
lowObfuscationpackage/build/dist/chunk-BFZ77DNT.jsmatched "fromCharCode"3
lowObfuscationpackage/build/dist/chunk-CAVWCVAX.jsmatched "fromCharCode"3
lowObfuscationpackage/build/dist/chunk-CPMWLSLU.jsmatched "\\u2028"3
lowObfuscationpackage/build/dist/chunk-GC5A67L5.jsmatched "\\x20"3
lowObfuscationpackage/build/dist/chunk-GZBCODHK.jsmatched "\\u2028"3
lowObfuscationpackage/build/dist/chunk-MIKJ46VC.jsmatched "fromCharCode"3
lowObfuscationpackage/build/dist/chunk-PJ3NZ7HS.jsmatched "fromCharCode"3
lowObfuscationpackage/build/dist/chunk-RFFTRMGK.jsmatched "\\x08"3
lowObfuscationpackage/build/dist/chunk-SLWAEMHP.jsmatched "fromCharCode"3
lowObfuscationpackage/build/dist/chunk-T3ZAZ4K2.jsmatched "\\u2028"3
lowObfuscationpackage/build/dist/chunk-UM73JACQ.jsmatched "\\u2028"3
lowObfuscationpackage/build/dist/iframe-sandbox/assets/index-CT51TZmB.jsmatched "fromCharCode"3
lowObfuscationpackage/build/dist/iframe-sandbox/assets/index-D_C6pEAs.jsmatched "fromCharCode"3
lowObfuscationpackage/build/index.jsmatched "atob("3
lowObfuscationpackage/build/dist/polyfills.jsmatched "\\xA9"3
lowObfuscationpackage/build/dist/worker-RHV2GGM4.jsmatched "fromCharCode"3

Manifest

Package metadata

Scripts5
  • bootstrappnpm prepare-dist && pnpm compile && pnpm types
  • compilenode scripts/build.js
  • prepare-distnode scripts/prepare_dist.js
  • testvitest
  • typesdts-bundle-generator src/index.ts -o build/index.d.ts --external-inlines altair-graphql-core --external-inlines altair-static --verbose
Dependencies1
  • zod^4.1.13