Package evidence

[email protected]

Credential file access: matched ".npmrc"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 3,233,669Ubiquitous · −70% score
Versions published: 1,343Mature · −50% score
First published: Mar 2021
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes740,034

Previous version7.0.0-beta.3

Published2026-06-15T20:35:49.093Z

SHA-2564282b158fee29b620562b5f87fe632ebe281b17b699d708b70a670b34a83f0ff

Why flagged

What the scanner saw

Credential file access: matched ".npmrc"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

41h agoLast checked

reviewRisk

1Score

7.0.0-beta.4Version

Status history (1 event)

new → available41h ago · risk review · score 1 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Credential file access	package/dist/cli/add/index.js	matched ".npmrc"	5

Manifest

Package metadata

Scripts14

buildpnpm run prebuild && astro-scripts build "src/**/*.{ts,js}" --copy-wasm && tsc -b && astro-check -- -- --root ./components
build:cipnpm run prebuild && astro-scripts build "src/**/*.{ts,js}" --copy-wasm
devastro-scripts dev --copy-wasm --prebuild "src/runtime/server/astro-island.ts" --prebuild "src/runtime/client/{idle,load,media,only,visible}.ts" "src/**/*.{ts,js}"
prebuildastro-scripts prebuild --to-string "src/runtime/server/astro-island.ts" "src/runtime/client/{idle,load,media,only,visible}.ts"
testpnpm run test:unit && pnpm run test:integration && pnpm run test:types
test:cliastro-scripts test "test/**/cli.test.ts"
test:e2epnpm test:e2e:chrome && pnpm test:e2e:firefox
test:e2e:chromeplaywright test
test:e2e:firefoxplaywright test --config playwright.firefox.config.js
test:e2e:matchplaywright test -g
test:integrationastro-scripts test "test/*.test.ts" --parallel --strip-types
test:matchastro-scripts test "test/**/*.test.ts" --match
test:typestsc --build test/types/tsconfig.json
test:unitastro-scripts test "test/units/**/*.test.ts" --strip-types --teardown ./test/units/teardown.ts

Dependencies56

@astrojs/compiler-rs^0.1.10
@astrojs/internal-helpers0.10.0
@astrojs/markdown-satteri0.3.1-beta.1
@astrojs/telemetry3.3.2
@capsizecss/unpack^4.0.0
@clack/prompts^1.1.0
@oslojs/encoding^1.1.0
@rollup/pluginutils^5.3.0
am-i-vibing^0.3.0
aria-query^5.3.2
axobject-query^4.1.0
ci-info^4.4.0
clsx^2.1.1
common-ancestor-path^2.0.0
cookie^1.1.1
devalue^5.8.1
diff^8.0.3
dset^3.1.4
es-module-lexer^2.0.0
esbuild^0.28.0
flattie^1.1.1
fontace~0.4.1
get-tsconfig5.0.0-beta.4
github-slugger^2.0.0
html-escaper3.0.3
http-cache-semantics^4.2.0
js-yaml^4.1.1
jsonc-parser^3.3.1
magic-string^0.30.21
magicast^0.5.2
…and 26 more.

Optional dependencies1

sharp^0.34.0