Package evidence

[email protected]

Credential file access: matched ".aws/"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 173Mature · −50% score
First published: Feb 2025
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes14,623,847

Previous version1.8.10

Published2026-06-12T16:26:19.389Z

SHA-256ed1ea4b6d1b265215cf8ce0f34b44c31cdf4977b92b6f80d64c39aaa9b78703d

Why flagged

What the scanner saw

Credential file access: matched ".aws/"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

4d agoLast checked

reviewRisk

6Score

1.8.11Version

Status history (1 event)

new → available4d ago · risk review · score 6 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Credential file access	package/dist/cjs/config.js	matched ".aws/"	5
low	Credential file access	package/dist/cjs/nextjsPlugin.js	matched ".aws/"	5
low	Credential file access	package/dist/cjs/nextServerLoader.js	matched ".aws/"	5
low	Credential file access	package/dist/cjs/worker.js	matched "AWS_ACCESS_KEY"	5

Manifest

Package metadata

Scripts32

buildnpm-run-all build:clean compile:rs build:no-native
build-allnpm run build --workspaces --include-workspace-root
build:cleanrm -rf ./dist/cjs && rm -rf ./dist/esm && rm -rf ./dist/types && rm -f ./dist/native/*.node && rm -rf ./src/version.ts
build:jsnpm-run-all generateVersion generateModuleName webpack:cjs webpack:esm
build:no-nativenpm-run-all build:js copy:types
build:tscnpm-run-all build:clean generateVersion compile:esm compile:cjs compile:types compile:rs
check:npmrcbash scripts/checkNpmrcCoverage.sh
compile:cjstsc -b ./tsconfig.cjs.json
compile:esmtsc -b ./tsconfig.esm.json
compile:rscd src/native && npm run build && cd - && npm run native:index
compile:type:apidts-bundle-generator -o dist/types/api.d.ts src/entries/api.ts
compile:type:esbuildplugindts-bundle-generator -o dist/types/esbuildPlugin.d.ts src/plugins/esbuildPlugin/esbuildPlugin.ts
compile:type:indexdts-bundle-generator -o dist/types/on_require.d.ts src/entries/on_require.ts
compile:type:nextjsplugindts-bundle-generator -o dist/types/nextjsPlugin.d.ts src/plugins/webpackPlugin/nextjsPlugin.ts
compile:type:registerdts-bundle-generator -o dist/types/on_register.d.ts src/entries/on_register.mts
compile:type:setupdts-bundle-generator -o dist/types/on_setup.d.ts src/entries/on_setup.ts
compile:typesnpm-run-all compile:type:index compile:type:register compile:type:esbuildplugin compile:type:nextjsplugin compile:type:setup compile:type:api copy:types-root
copy:typesmkdir -p ./dist/types && cp ./types/* ./dist/types/ && npm run copy:types-root
copy:types-rootcp dist/types/esbuildPlugin.d.ts esbuildPlugin.d.ts && cp dist/types/nextjsPlugin.d.ts nextjsPlugin.d.ts && cp dist/types/api.d.ts api.d.ts && cp dist/types/on_setup.d.ts setup.d.ts && cp dist/types/on_register.d.ts register.d.ts
formatprettier --write "src/**/*.{js,ts,mts,mjs,cjs,json}" "test/**/*.{js,ts,mts,mjs,cjs,json}"
format:checkprettier --ignore-path ./prettier-ignore.txt --check "src/**/*.{js,ts,mts,mjs,cjs,json}" "test/**/*.{js,ts,mts,mjs,cjs,json}"
generate-declsNODE_PATH=`realpath ./test/node_modules` ts-node ./test/instrumentation/generateNewFunctionNames.ts
generateModuleNamenode scripts/generateModuleName.js
generateVersionnode scripts/generateVersion.js
lintnpm run lint:check -- --fix
lint:checknpx eslint -c eslint.config.mjs src
native:indexmkdir -p ./dist/native && cp ./src/native/_index.js ./dist/native/_index.js
testNODE_OPTIONS='--experimental-vm-modules' NODE_PATH=`realpath ./test/node_modules` vitest
test:civitest
validateArtifactsnode scripts/validateArtifacts.js `realpath .`
…and 2 more.

Dependencies17

@babel/core^7.24.0
@cspotcode/source-map-support^0.8.1
@jridgewell/sourcemap-codec^1.5.0
array-flatten1.1.1
axios^1.6.8
buffer-crc32^1.0.0
commander^13.1.0
form-data^4.0.4
p-limit^3.1.0
require-in-the-middle^7.3.0
safe-stable-stringify^2.5.0
semver^7.6.2
source-map^0.7.4
strnum2.3.0
typescript^5.4.5
uuid^10.0.0
zod~3.23.8