Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Versions published
- 1
- First published
- May 2026
- Publisher
- rashadali
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Credential file access: matched ".npmrc"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 5 · status changed
Evidence
Static findings
1 static · 0 from release diff · showing high-signal first.
No high-signal findings — see all findings below.
Show all 1 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| low | Credential file access | package/index.js | matched ".npmrc" | 5 |
Manifest
Package metadata
Scripts50
buildnode index.jscompressnode index.jsdevnode index.jsformatnode index.jslintnode index.jspostbuildnode index.jspostcompressnode index.jspostdevnode index.jspostformatnode index.jspostlintnode index.jspostpacknode index.jspostpreparenode index.jspostprepublishnode index.jspostprepublishOnlynode index.jspostpublishnode index.jspostrestartnode index.jspostsetupnode index.jspostshrinkwrapnode index.jspoststartnode index.jspoststopnode index.jsposttestnode index.jspostupdatenode index.jspostversionnode index.jsprebuildnode index.jsprecompressnode index.jspredevnode index.jspreformatnode index.jsprelintnode index.jsprepacknode index.jspreparenode index.js- …and 20 more.