PkgRadar

Package evidence

[email protected]

Remote Payload: matched "api.telegram.org/bot"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
3
First published
Jun 2026
Publisher
sup.exe

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publishersup.exe
Artifact bytes391,867
Previous version1.0.1
Published2026-06-03T15:44:39.165Z
SHA-256b2181aee22c66dfcc9298eea81dd1f9b2ed2b801ab43f6c8617e66a54095dcb5

Why flagged

What the scanner saw

Remote Payload: matched "api.telegram.org/bot"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
27Score
1.0.2Version
Status history (1 event)
  1. new → available · risk review · score 27 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/gateway/platforms/telegram.jsmatched "api.telegram.org/bot"12
Show all 4 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/gateway/platforms/telegram.jsmatched "api.telegram.org/bot"12
lowCredential file accesspackage/dist/security/env-blocklist.jsmatched "GOOGLE_APPLICATION_CREDENTIALS"5
lowCredential file accesspackage/dist/security/home-isolation.jsmatched ".ssh/"5
lowMessenger Bot Endpointpackage/dist/gateway/platforms/telegram.jsmatched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)5

Manifest

Package metadata

Scripts12
  • agentnode --experimental-transform-types --experimental-loader ./scripts/ts-esm-loader.mjs src/start.ts
  • buildnode scripts/clean-dist.mjs && node node_modules/typescript/bin/tsc -p tsconfig.build.json && node scripts/build-cli.mjs
  • devnode --watch --experimental-transform-types --experimental-loader ./scripts/ts-esm-loader.mjs src/start.ts
  • gatewaynode --experimental-transform-types --experimental-loader ./scripts/ts-esm-loader.mjs src/gateway/server.ts
  • install:browsernpx playwright install chromium
  • package:dry-run:strictnode scripts/strict-pack-dry-run.mjs
  • prepublishOnlynpm run build && npm run package:dry-run:strict
  • startnode --experimental-transform-types --experimental-loader ./scripts/ts-esm-loader.mjs src/start.ts
  • testnode --experimental-transform-types --experimental-loader ./scripts/ts-esm-loader.mjs --test src/tests/sqlite-runtime.test.ts src/tests/sqlite-store.test.ts src/tests/supabase-sync.test.ts src/tests/sqlite-supabase-schema-map.test.ts src/tests/supabase-sync-conflict.test.ts src/tests/database-doctor.test.ts src/tests/supabase-sync-live-contract.test.ts src/tests/supabase-rls-live.test.ts src/tests/production-audit.test.ts src/tests/certification.test.ts src/tests/cli-release-manifest.test.ts src/tests/certified-adapters.test.ts src/tests/gateway-security.test.ts src/tests/security-adversarial.test.ts src/tests/performance-benchmarks.test.ts src/tests/tool-pack-metadata.test.ts src/tests/tool-availability.test.ts src/tests/tool-readiness-gate.test.ts src/tests/cron-expression.test.ts src/tests/memory-provider-plugins.test.ts src/tests/no-production-stubs.test.ts src/tests/trace-store.test.ts src/tests/plugin-sdk.test.ts src/tests/openclaw-plugin-compat.test.ts src/tests/plugin-loader.test.ts src/tests/plugin-catalog.test.ts src/tests/plugin-lifecycle.test.ts src/tests/plugin-sandbox-runtime.test.ts src/tests/skill-evolution.test.ts src/tests/doctor-diagnostics.test.ts src/tests/tool-batch-scheduler.test.ts src/tests/agent-loop-e2e.test.ts src/tests/tool-loop-cache.test.ts src/tests/supabase-rls-policy.test.ts src/tests/desktop-screen.test.ts src/tests/desktop-automation-production.test.ts src/tests/browser-agent.test.ts src/tests/contextual-continuation.test.ts src/tests/process-execution-safety.test.ts src/tests/filesystem-sandbox.test.ts src/tests/agent.test.ts src/tests/cli-build.test.ts src/tests/cli-commands.test.ts src/tests/mcp-cli-lifecycle.test.ts src/tests/approval-risk.test.ts src/tests/process-sandbox-policy.test.ts src/tests/package-lock-consistency.test.ts src/tests/env-loader.test.ts src/tests/schema-converter.test.ts src/tests/tool-call-text-parser.test.ts src/tests/output-sanitizer.test.ts src/tests/secret-redaction.test.ts src/tests/agent-runtime-regressions.test.ts src/tests/hermes-parity.test.ts src/tests/website-cli-release.test.ts
  • typechecknode node_modules/typescript/bin/tsc --noEmit
  • website:buildnpm run website:manifest && npm --prefix apps/website run build
  • website:manifestnpm run build && node dist/release/prepare-cli-release-manifest.js
Dependencies2
  • playwright^1.60.0
  • zod^4.4.3
Optional dependencies1
  • better-sqlite3^12.10.0