Package evidence

[email protected]

Credential file access: matched ".npmrc"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 846
Versions published: 218Mature · −50% score
First published: Jul 2021
Publisher: jfrog

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherjfrog

Artifact bytes33,193,603

Previous version2.5.1

Published2021-11-21T20:30:13.531Z

SHA-256332244cc41da36c24a7527dc365cb64494a9a8334fbff477ad3464939b252328

Why flagged

What the scanner saw

Credential file access: matched ".npmrc"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

5d agoLast checked

reviewRisk

15Score

2.6.0Version

Status history (1 event)

new → available5d ago · risk review · score 15 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Credential file access	package/node-v8.11.1-linux-x64/lib/node_modules/npm/lib/config/core.js	matched ".npmrc"	10
medium	Credential file access	package/node-v8.11.1-linux-x64/lib/node_modules/npm/lib/config/defaults.js	matched ".npmrc"	10

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Credential file access	package/node-v8.11.1-linux-x64/lib/node_modules/npm/lib/config/core.js	matched ".npmrc"	10
medium	Credential file access	package/node-v8.11.1-linux-x64/lib/node_modules/npm/lib/config/defaults.js	matched ".npmrc"	10
low	Credential file access	package/node-v8.11.1-linux-x64/lib/node_modules/npm/lib/npm.js	matched ".npmrc"	5
low	Credential file access	package/node-v8.11.1-linux-x64/lib/node_modules/npm/node_modules/npm-packlist/index.js	matched ".npmrc"	5

Manifest

Package metadata

Scripts9

dumpconfenv | grep npm | sort | uniq
preparenode bin/npm-cli.js --no-timing prune --prefix=. --no-global && rimraf test/*/*/node_modules && make -j4 doc
preversionbash scripts/update-authors.sh && git add AUTHORS && git commit -m "update AUTHORS" || true
taptap --timeout 300
tap-covertap --nyc-arg='--cache' --coverage --timeout 600
teststandard && npm run test-tap
test-coveragenpm run tap-cover -- "test/tap/*.js" "test/network/*.js" "test/broken-under-*/*.js"
test-nodetap --timeout 240 "test/tap/*.js" "test/network/*.js" "test/broken-under-nyc*/*.js"
test-tapnpm run tap -- "test/tap/*.js" "test/network/*.js" "test/broken-under-*/*.js"

Dependencies96

JSONStream~1.3.1
abbrev~1.1.1
ansi-regex~3.0.0
ansicolors~0.3.2
ansistyles~0.1.3
aproba~1.2.0
archy~1.0.0
bin-links^1.1.0
bluebird~3.5.1
cacache~10.0.1
call-limit~1.1.0
chownr~1.0.1
cli-table2~0.2.0
cmd-shim~2.0.2
columnify~1.5.4
config-chain~1.1.11
detect-indent~5.0.0
dezalgo~1.0.3
editor~1.0.0
find-npm-prefix~1.0.1
fs-vacuum~1.2.10
fs-write-stream-atomic~1.0.10
gentle-fs^2.0.1
glob~7.1.2
graceful-fs~4.1.11
has-unicode~2.0.1
hosted-git-info~2.5.0
iferr~0.1.5
inflight~1.0.6
inherits~2.0.3
…and 66 more.