Package evidence

[email protected]

Known Indicator Filename: package/dist/cjs/core/authorization/execution.js

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

PublisherGitHub Actions

Artifact bytes515,021

Previous version6.0.0-alpha.1

Published2026-05-23T12:39:17.310Z

SHA-256f9d1bb876c4339153d9c02e4a30ac93ad8b14177ae969b4891688e012c21af3d

Why flagged

What the scanner saw

Known Indicator Filename: package/dist/cjs/core/authorization/execution.js

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

24d agoLast checked

highRisk

106Score

6.0.0-alpha.2Version

Status history (1 event)

new → available24d ago · risk high · score 106 · status changed

Related candidates

Linked campaigns and clusters

Repeated static TTPstale

Known Indicator Filename — package/dist/esm/core/authorization/execution.js

2 members · evidence strength 70

Repeated static TTPstale

Known Indicator Filename — package/dist/cjs/core/authorization/execution.js

2 members · evidence strength 70

Evidence

Static findings

7 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Known Indicator Filename	package/dist/cjs/core/authorization/execution.js	package/dist/cjs/core/authorization/execution.js	45
high	Known Indicator Filename	package/dist/esm/core/authorization/execution.js	package/dist/esm/core/authorization/execution.js	45

Show all 7 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Known Indicator Filename	package/dist/cjs/core/authorization/execution.js	package/dist/cjs/core/authorization/execution.js	45
high	Known Indicator Filename	package/dist/esm/core/authorization/execution.js	package/dist/esm/core/authorization/execution.js	45
low	Install-time lifecycle script	package.json	prepare="husky"	4
low	Obfuscation	package/dist/cjs/arangodb/aql-generator.js	matched "EVAL("	3
low	Obfuscation	package/dist/esm/arangodb/aql-generator.js	matched "EVAL("	3
low	Obfuscation	package/dist/cjs/inmemory/inmemory-adapter.js	matched "eval("	3
low	Obfuscation	package/dist/esm/inmemory/inmemory-adapter.js	matched "eval("	3

Manifest

Package metadata

Scripts18

arangodb:startarangodb --starter.mode=single --starter.local --starter.port=8528 --starter.data-dir=./db start
arangodb:stoparangodb --starter.mode=single --starter.local --starter.port=8528 --starter.data-dir=./db stop
build./build.sh
compile-json-schemanode scripts/compile-json-schema.js
dev-servertsx ./src/dev-server/start.ts
knipknip
knip:prodknip --production
preparehusky
prepublishOnlynpm run build
testvitest run
test:dropdbtsx src/testing/regression-tests/drop-test-db.ts
test:perftsx src/testing/performance-tests/run.ts
test:regressionvitest run src/testing/regression-tests/regressions.spec.ts
test:regression:arangoCRUDDL_DB=arangodb vitest run src/testing/regression-tests/regressions.spec.ts
test:regression:in-memoryCRUDDL_DB=in-memory vitest run src/testing/regression-tests/regressions.spec.ts
test:regression:updateCRUDDL_DB=arangodb CRUDDL_UPDATE_EXPECTED=true vitest run src/testing/regression-tests/regressions.spec.ts
test:watchvitest
typechecktsc -p tsconfig.test.json && tsc -p tsconfig.build.json

Dependencies13

@graphql-tools/schema^10.0.31
@js-joda/core^5.2.0
ajv^8.11.0
ansi-styles^5.2.0
arangojs^10.0.0
fast-equals^6.0.0
graphql-tag^2.12.4
jsonc-parser^3.3.1
memorize-decorator^0.2.2
pluralize^8.0.0
tslib^2.4.0
yaml^2.8.1
yaml-ast-parser0.0.43