Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Publisher
- GitHub ActionsTrusted automation · −70% score
Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
DNS / OAST exfiltration: matched "dns.resolve"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 229 · status changed
Related candidates
Linked campaigns and clusters
Install Lifecycle Remote Or Exec — prepare="bash -lc 'if [ -f scripts/install-pre-commit.sh ]; then bash scripts/install-pre-commit.sh; else echo \"skipping install-pre-commit; script missing\"; fi'"
2 members · evidence strength 70Evidence
Static findings
19 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | DNS / OAST exfiltration | package/build/tools/network/dig/index.js | matched "dns.resolve" | 30 |
| high | DNS / OAST exfiltration | package/build/tools/network/nslookup/index.js | matched "dns.lookup" | 30 |
| high | Credential file access | package/build/tools/network/scp/index.js | matched ".ssh" | 30 |
| high | Credential file access | package/build/tools/network/ssh/index.js | matched ".ssh" | 30 |
| high | Install Lifecycle Remote Or Exec | package.json | prepare="bash -lc 'if [ -f scripts/install-pre-commit.sh ]; then bash scripts/install-pre-commit.sh; else echo \"Skipping install-pre-commit; script missing\"; fi'" | 30 |
| medium | Remote Payload | package/build/index.js | matched "curl " | 12 |
| medium | Remote Payload | package/build/tools/ansible/show_ansible_reference/index.js | matched "curl\n\n" | 12 |
| medium | Remote Payload | package/build/tools/crypto/generate_basic_auth/index.js | matched "curl " | 12 |
| medium | Remote Payload | package/build/tools/network/curl/index.js | matched "curl " | 12 |
Show all 19 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | DNS / OAST exfiltration | package/build/tools/network/dig/index.js | matched "dns.resolve" | 30 |
| high | DNS / OAST exfiltration | package/build/tools/network/nslookup/index.js | matched "dns.lookup" | 30 |
| high | Credential file access | package/build/tools/network/scp/index.js | matched ".ssh" | 30 |
| high | Credential file access | package/build/tools/network/ssh/index.js | matched ".ssh" | 30 |
| high | Install Lifecycle Remote Or Exec | package.json | prepare="bash -lc 'if [ -f scripts/install-pre-commit.sh ]; then bash scripts/install-pre-commit.sh; else echo \"Skipping install-pre-commit; script missing\"; fi'" | 30 |
| medium | Remote Payload | package/build/index.js | matched "curl " | 12 |
| medium | Remote Payload | package/build/tools/ansible/show_ansible_reference/index.js | matched "curl\n\n" | 12 |
| medium | Remote Payload | package/build/tools/crypto/generate_basic_auth/index.js | matched "curl " | 12 |
| medium | Remote Payload | package/build/tools/network/curl/index.js | matched "curl " | 12 |
| low | Install-time lifecycle script | package.json | prepare="bash -lc 'if [ -f scripts/install-pre-commit.sh ]; then bash scripts/install-pre-commit.sh; else echo \"Skipping install-pre-commit; script missing\"; fi'" | 4 |
| low | Obfuscation | package/build/index.js | matched "\\x08" | 3 |
| low | Obfuscation | package/build/tools/ansible/decrypt_ansible_vault/index.js | matched "Buffer.from(dataLines, 'base64" | 3 |
| low | Obfuscation | package/build/tools/crypto/decode_jwt/index.js | matched "Buffer.from(parts[0], 'base64" | 3 |
| low | Obfuscation | package/build/tools/data_format/format_json/index.js | matched "eval(" | 3 |
| low | Obfuscation | package/build/tools/encoding/convert_text_to_binary/index.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/tools/encoding/decode_base64/index.js | matched "Buffer.from(text, 'base64" | 3 |
| low | Obfuscation | package/build/tools/forensic/identify_file_type/index.js | matched "Buffer.from(data, 'base64" | 3 |
| low | Obfuscation | package/build/tools/text/convert_text_to_unicode/index.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/tools/text/slugify_text/index.js | matched "\\u0300" | 3 |
Manifest
Package metadata
Scripts19
buildnpm run sync:manifest || true && tsc && chmod +x build/index.jsbuild:dockertsc && chmod +x build/index.jsdeploy:buildnpm run build && docker buildx build --platform linux/amd64,linux/arm64 --provenance=true --sbom=true -t it-tools-mcp:latest .deploy:prodnpm run deploy:build && docker-compose up -ddevNODE_ENV=development MCP_DEV_MODE=true tsc && node build/index.jsdev:buildNODE_ENV=development tscdocker:builddocker buildx build --platform linux/amd64,linux/arm64 --provenance=true --sbom=true -t it-tools-mcp .docker:build:localdocker build -t it-tools-mcp .docker:rundocker-compose up --builddocker:stopdocker-compose downmcp:loginmcp-publisher login githubmcp:publishmcp-publisher publishpreparebash -lc 'if [ -f scripts/install-pre-commit.sh ]; then bash scripts/install-pre-commit.sh; else echo "Skipping install-pre-commit; script missing"; fi'setup:hookschmod +x .git/hooks/pre-commitstartdocker-compose up --buildstart:nodenode build/index.jssync:manifestnode scripts/sync-manifest.mjstestclear;node tests/test-server.mjstest:allclear;node tests/all-tools-test.mjs
Dependencies34
@iarna/toml^2.2.5@modelcontextprotocol/sdk^1.24.3@types/js-yaml^4.0.9@types/papaparse^5.3.16@types/qrcode^1.5.5bcryptjs^3.0.2bip39^3.1.0color^5.0.0cron-parser^5.3.0diff^8.0.2emoji-js^3.8.1figlet^1.8.1html-to-text^9.0.5iban^0.0.14js-yaml^4.1.0libphonenumber-js^1.12.9marked^16.0.0mathjs^15.2.0mime-types^3.0.1papaparse^5.5.3ping^0.4.4ps-list^8.1.1qrcode^1.5.4read-last-lines^1.8.0shell-escape^0.2.0speakeasy^2.0.0sql-formatter^15.6.6ssh2^1.16.0telnet-client^2.2.5turndown^7.2.0- …and 4 more.