PkgRadar

Package evidence

[email protected]

Credential file access: matched "GOOGLE_APPLICATION_CREDENTIALS"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
7
Versions published
62Established · −30% score
First published
Nov 2025
Publisher
veeronecorp

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherveeronecorp
Artifact bytes8,870,548
Previous version3.1.1
Published2026-05-14T07:19:02.562Z
SHA-2568c1907e9d233bf11089d8d0cfb5523bceee26a39ba47b62b19074e8eb862100c

Why flagged

What the scanner saw

Credential file access: matched "GOOGLE_APPLICATION_CREDENTIALS"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
3Score
3.2.0Version
Status history (1 event)
  1. new → available · risk review · score 3 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 3 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/dist/esm/services/ai/config.jsmatched "GOOGLE_APPLICATION_CREDENTIALS"5
lowLarge Javascript Payloadpackage/dist/index.js5922254 bytes0
lowLarge Javascript Payloadpackage/dist/index.mjs5614611 bytes0

Manifest

Package metadata

Scripts89
  • analyzenpm run build && npx bundle-analyzer dist/index.mjs
  • audit:3.0.7-sourcenode scripts/audit/3.0.7-source-audit.js
  • audit:3.1-frame-loopnode scripts/audit/3.1-frame-loop-audit.js
  • audit:3.1-frame-loop:strictnode scripts/audit/3.1-frame-loop-audit.js --strict
  • audit:apinpm run audit:exports && node scripts/audit/api-surface-audit.js
  • audit:componentsnode scripts/audit/universal-glass-audit.js
  • audit:exportsnode scripts/audit/public-export-audit.js
  • audit:runtimenode scripts/audit/runtime-cleanliness-audit.js
  • audit:uxnpm run codemod:tw-to-glass && npm run lint:check && npm run lint:tokens && npm run lint:styles && npm run test:visual:ci
  • buildnpm run glass:generate-persona-css && node scripts/build-all.js
  • build-storybookstorybook build
  • build:servertsc --project tsconfig.server.json
  • build:tokensnode scripts/build-tokens.js
  • build:workersnode scripts/build-workers.js
  • check:perfnpm run build && npm run size-check
  • cinpm run glass:full-check && npm run test:coverage
  • codemod:allnpm run codemod:tokens && npm run codemod:focus
  • codemod:focusnode tools/codemods/focusify.mjs
  • codemod:tokensnode tools/codemods/auraglass-from-raw.mjs
  • codemod:tw-to-glassnode scripts/codemods/tw-to-glass.js
  • deploy./scripts/deploy.sh
  • devrollup -c --watch
  • docker:builddocker-compose build
  • docker:downdocker-compose down
  • docker:logsdocker-compose logs -f
  • docker:updocker-compose up -d
  • glass:full-checknpm run typecheck && npm run lint:check && npm run lint:tokens && npm run lint:styles && npm run glass:validate-persona-css && npm run glass:validate && npm run test:glass-contrast && npm run test:tokens:exports && npm run test:exports && npm run test:types
  • glass:generate-cssnode scripts/generate-glass-css-simple.js
  • glass:generate-persona-cssnode scripts/generate-persona-css-runner.js
  • glass:validatenode scripts/verify-glass-pipeline.js
  • …and 59 more.
Dependencies9
  • chart.js^4.5.0
  • clsx^2.0.0
  • date-fns^4.1.0
  • framer-motion^11.18.2
  • react-chartjs-2^5.3.0
  • react-hook-form^7.54.0
  • socket.io-client^4.8.3
  • tailwind-merge^3.3.1
  • zod^3.22.0