PkgRadar

Package evidence

[email protected]

Credential file access: matched "NPM_TOKEN"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
15
First published
Apr 2026
Publisher
fabrijk96

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherfabrijk96
Artifact bytes613,242
Previous version0.15.0
Published2026-05-27T17:36:35.050Z
SHA-25607c5a7d3e54e5890e854be609cb7d8fc46b5350a271738a9cb62ac1fe501096b

Why flagged

What the scanner saw

Credential file access: matched "NPM_TOKEN"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
30Score
0.15.1Version
Status history (1 event)
  1. new → available · risk review · score 30 · status changed

Evidence

Static findings

6 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 6 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/src/create-quiver/lib/evidence.jsmatched "NPM_TOKEN"5
lowCredential file accesspackage/src/create-quiver/lib/ai/github.jsmatched ".ssh"5
lowCredential file accesspackage/src/create-quiver/index.jsmatched ".ssh"5
lowCredential file accesspackage/src/create-quiver/lib/init-docs.jsmatched ".ssh"5
lowCredential file accesspackage/src/create-quiver/lib/ai/safety.jsmatched ".ssh"5
lowCredential file accesspackage/scripts/init-docs.shmatched ".ssh"5

Manifest

Package metadata

Scripts40
  • check:prbash tools/scripts/check-pr-readiness.sh
  • check:slicebash tools/scripts/check-slice-readiness.sh
  • cleanup:slicebash tools/scripts/cleanup-slice.sh
  • migratebash tools/scripts/migrate-project.sh
  • package:quiverbash scripts/package-quiver.sh
  • quiver:ai:agentnpx create-quiver ai agent
  • quiver:ai:approvenpx create-quiver ai approve
  • quiver:ai:doctornpx create-quiver ai doctor
  • quiver:ai:execute-plannpx create-quiver ai execute-plan
  • quiver:ai:execute-slicenpx create-quiver ai execute-slice
  • quiver:ai:exportnpx create-quiver ai export
  • quiver:ai:inspectnpx create-quiver ai inspect
  • quiver:ai:onboardnpx create-quiver ai onboard
  • quiver:ai:plannpx create-quiver ai plan
  • quiver:ai:prnpx create-quiver ai pr
  • quiver:ai:prepare-contextnpx create-quiver ai prepare-context
  • quiver:ai:prompt-slicenpx create-quiver ai prompt-slice
  • quiver:ai:review-plannpx create-quiver ai review-plan
  • quiver:ai:slicesnpx create-quiver ai slices list
  • quiver:ai:specsnpx create-quiver ai specs list
  • quiver:ai:tracenpx create-quiver ai trace report
  • quiver:analyzenpx create-quiver analyze
  • quiver:doctornpx create-quiver doctor
  • quiver:evidencenpx create-quiver evidence
  • quiver:flownpx create-quiver flow
  • quiver:graphnode bin/create-quiver.js graph
  • quiver:nextnpx create-quiver next
  • quiver:plannode bin/create-quiver.js plan
  • quiver:preparenpx create-quiver prepare
  • quiver:spec:closenpx create-quiver spec close
  • …and 10 more.
Dependencies2
  • @clack/prompts^1.4.0
  • zod^4.4.3