Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Versions published
- 245Mature · −50% score
- First published
- May 2025
- Publisher
- pyramation
Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Credential file access: matched "AWS_ACCESS_KEY"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 10 · status changed
Evidence
Static findings
4 static · 0 from release diff · showing high-signal first.
No high-signal findings — see all findings below.
Show all 4 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| low | Credential file access | package/bucket-provisioner-resolver.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/esm/bucket-provisioner-resolver.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/esm/presigned-url-resolver.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/presigned-url-resolver.js | matched "AWS_ACCESS_KEY" | 5 |
Manifest
Package metadata
Scripts7
buildmakage buildbuild:devmakage build --devcleanmakage cleanlinteslint . --fixprepacknpm run buildtestjesttest:watchjest --watch
Dependencies42
@aws-sdk/client-s3^3.1052.0@constructive-io/bucket-provisioner^0.12.0@constructive-io/graphql-env^3.13.0@constructive-io/graphql-types^3.12.0@constructive-io/s3-streamer^2.26.0@constructive-io/s3-utils^2.18.0@constructive-io/upload-names^2.17.0@dataplan/json1.0.0@dataplan/pg1.0.3@graphile-contrib/pg-many-to-many2.0.0-rc.2@pgpmjs/logger^2.12.0@pgpmjs/types^2.29.0@pgsql/quotes^17.1.0cors^2.8.6express^5.2.1grafast1.0.2grafserv1.0.0graphile-bucket-provisioner-plugin0.12.0graphile-build5.0.2graphile-build-pg5.0.2graphile-bulk-mutations^0.5.4graphile-config1.0.1graphile-connection-filter^1.12.4graphile-i18n^1.2.5graphile-llm^0.12.1graphile-ltree^1.9.5graphile-pg-aggregates^1.5.4graphile-postgis^2.18.4graphile-presigned-url-plugin^0.20.0graphile-realtime-subscriptions^0.8.1- …and 12 more.