Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 2,047Niche · −30% score
- Versions published
- 252Mature · −50% score
- First published
- Nov 2020
- Publisher
- GitHub ActionsTrusted automation · −70% score
Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Credential file access: matched ".ssh/"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 6 · status changed
Evidence
Static findings
2 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Credential file access | package/src/utility/platformInfo.js | matched ".ssh/" | 10 |
| medium | Credential file access | package/src/utility/SSHConnection.js | matched "id_rsa" | 10 |
Manifest
Package metadata
Scripts18
buildwebpackbuild:docjsdoc2md --template doctpl.hbs ./src/shell/* > ../../../dbgate.github.io/_docs/apidoc.mdstartenv-cmd -f .env node src/index.js --listen-apistart:authenv-cmd -f env/auth/.env node src/index.js --listen-apistart:azureenv-cmd -f env/azure/.env node src/index.js --listen-apistart:dbloginenv-cmd -f env/dblogin/.env node src/index.js --listen-apistart:debugenv-cmd -f .env node --inspect src/index.js --listen-apistart:e2e:teamcross-env DEVWEB=1 DEVMODE=1 env-cmd -f ../../e2e-tests/env/team/.env node src/index.js --listen-apistart:filedbenv-cmd node src/index.js /home/jena/test/chinook/Chinook.db --listen-apistart:portalenv-cmd -f env/portal/.env node src/index.js --listen-apistart:sfillenv-cmd -f env/sfill/.env node src/index.js --listen-apistart:singleconnenv-cmd node src/index.js --server localhost --user root --port 3307 --engine mysql@dbgate-plugin-mysql --password test --listen-apistart:singledbenv-cmd -f env/singledb/.env node src/index.js --listen-apistart:storageenv-cmd -f env/storage/.env node src/index.js --listen-apistart:storage:builtenv-cmd -f env/storage/.env cross-env DEVMODE= BUILTWEBMODE=1 node dist/bundle.js --listen-apitestjesttest:cijest --json --outputFile=result.json --testLocationInResultststsc
Dependencies45
@aws-sdk/rds-signer^3.665.0activedirectory2^2.1.0archiver^7.0.1async-lock^1.2.6axios^1.13.2body-parser^1.19.0byline^5.0.0compare-versions^3.6.0cors^2.8.5cross-env^6.0.3dbgate-datalib7.2.0dbgate-query-splitter^4.12.0dbgate-rest7.2.0dbgate-sqltree7.2.0dbgate-tools7.2.0debug^4.3.4diff^5.0.0diff2html^3.4.13eslint^6.8.0express^4.17.1express-basic-auth^1.2.0express-fileupload^1.2.0fs-extra^9.1.0fs-reverse^0.0.3get-port^5.1.1http^0.0.0is-electron^2.2.1js-yaml^4.1.0json-stable-stringify^1.0.1jsonwebtoken^8.5.1- …and 15 more.