Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Credential file access: matched ".aws"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 309 · status changed
Related candidates
Linked campaigns and clusters
ddesio
3 members · evidence strength 74Evidence
Static findings
91 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/dist/compression/index.js | matched ".aws" | 30 |
| medium | Obfuscation Density | package/dist/bin/commands/export.js | high encoded/escaped-token density | 12 |
Show all 91 findings (low-signal and informational)
Showing 60 of 91 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/dist/compression/index.js | matched ".aws" | 30 |
| medium | Obfuscation Density | package/dist/bin/commands/export.js | high encoded/escaped-token density | 12 |
| low | Obfuscation | package/dist/bin/installer/targets/aider.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/amp.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/antigravity.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/commands/architecture.js | matched "\\x1B" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/augment.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/compression/filters/aws.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/banner.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/bin/banner.js | matched "\\x1B" | 3 |
| low | Obfuscation | package/dist/bin/commands/caveman.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/dist/bin/installer/caveman.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/claude.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/installer/cli-agent.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/cline.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/codex.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/memory/compress.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/dist/bin/commands/compression.js | matched "\\u25CF" | 3 |
| low | Obfuscation | package/dist/bin/installer/config-prompt.js | matched "\\xB7" | 3 |
| low | Obfuscation | package/dist/bin/commands/context.js | matched "\\xB7" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/continue.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/copilot.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/commands/coupling.js | matched "\\u2588" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/cursor.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/commands/dashboard.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/installer/dashboard.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/devin.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/compression/filters/docker.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/frameworks/docker.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/dist/bin/commands/exec.js | matched "\\u2500" | 3 |
| low | Obfuscation | package/dist/bin/commands/export.js | matched "\\u2B21" | 3 |
| low | Obfuscation | package/dist/extraction/extractor.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/bin/commands/files.js | matched "\\u2514" | 3 |
| low | Obfuscation | package/dist/compression/filters/files.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/bin/commands/gain.js | matched "\\u2588" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/gemini-cli.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/generic.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/compression/filters/generic.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/compression/filters/git.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/dist/compression/filters/github.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/goose.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/commands/help.js | matched "\\x1B" | 3 |
| low | Obfuscation | package/dist/bin/installer/hooks.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/bin/commands/hotspots.js | matched "\\u2588" | 3 |
| low | Obfuscation | package/dist/bin/commands/index.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/installer/index.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/compression/index.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/context/index.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/installer/index.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/vectors/index.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/bin/commands/init.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/junie.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/kilo.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/kirograph.js | matched "\\u2716" | 3 |
| low | Obfuscation | package/dist/vectors/lancedb-index.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/compression/filters/lint.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/bin/installer/mcp.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/bin/commands/memory.js | matched "\\u2716" | 3 |
| low | Obfuscation | package/dist/compression/filters/misc.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/bin/installer/targets/opencode.js | matched "\\u2713" | 3 |
Manifest
Package metadata
Scripts6
buildtsx scripts/build.tscleannode -e "require('fs').rmSync('dist',{recursive:true,force:true})"devtsx scripts/build.ts --watchdocsnpx serve docstestvitest --runtypechecktsc --noEmit
Dependencies7
@huggingface/transformers^3.0.0commander^14.0.2figlet^1.11.0node-sqlite3-wasm^0.8.30picomatch^4.0.3tree-sitter-wasms^0.1.11web-tree-sitter^0.25.3
Optional dependencies9
@electric-sql/pglite^0.2.17@lancedb/lancedb^0.27.2@orama/orama^3.1.18@orama/plugin-data-persistence^3.1.18@qdrant/qdrant-js^1.17.0better-sqlite3^11.10.0qdrant-local^0.0.0-alpha.10sqlite-vec^0.1.9typesense^3.0.6