Package evidence

[email protected]

Credential file access: matched ".npmrc"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 19
Versions published: 33Established · −30% score
First published: Jun 2025
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes66,743

Previous version0.2.28

Published2026-03-13T23:41:03.107Z

SHA-2563936681b24ab2891ff7a5a45213b18c2e23cd897776f62be756ea3264be59186

Why flagged

What the scanner saw

Credential file access: matched ".npmrc"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

4h agoLast checked

reviewRisk

9Score

0.2.29Version

Status history (1 event)

new → available4h ago · risk review · score 9 · status changed

Evidence

Static findings

6 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 6 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Credential file access	package/lib/services/NpmrcService.js	matched ".npmrc"	5
low	Credential file access	package/lib/types/PackageManager.js	matched ".npmrc"	5
low	Credential file access	package/lib/services/PackageManagerService/RegistryConfigService/RegistryConfigService.js	matched ".npmrc"	5
low	Credential file access	package/lib/services/NpmrcService.ts	matched ".npmrc"	5
low	Credential file access	package/lib/types/PackageManager.ts	matched ".npmrc"	5
low	Credential file access	package/lib/services/PackageManagerService/RegistryConfigService/RegistryConfigService.ts	matched ".npmrc"	5

Manifest

Package metadata

Scripts19

buildrimraf lib && pnpm build:withoutClean
build:withoutCleantsc -p tsconfig.build.json && tsx scripts/copyTsFiles.ts && pnpm propagateVersion
checktsc --noEmit
checkAllpnpm build && pnpm lint && pnpm test && pnpm jsr:validate
jsr:publishtb pkg publishJsr
jsr:validatetb pkg validateJsr
linteslint
npm:publishtb pkg publishNpm --alternative-names local-npm-registry
npm:validatetb pkg validateNpm --alternative-names local-npm-registry
preparePkgtb pkg prepare
propagateVersiontsx ../../scripts/propagateVersion.ts
refreshpnpm build && npm uninstall -g local-npm-registry && npm install -g .
reset:globalnpm uninstall -g local-npm-registry && npm install -g local-npm-registry
testvitest run
test:packageNameReplacetb pkg testStringReplacement local-npm-registry local-npm-registry
upgrade:allpnpm update '!@aneuhold/*' --latest
upgrade:corepnpm update '@aneuhold/main-scripts' --latest
versionPropagation:validatetsx ../../scripts/validatePackageVersions.ts
watchnodemon --ignore lib/ -e ts --exec "pnpm build:withoutClean"

Dependencies7

@aneuhold/core-ts-lib^2.4.2
commander^14.0.2
execa^9.6.1
fs-extra^11.3.2
js-yaml^4.1.1
proper-lockfile^4.1.2
verdaccio^6.2.4