Package evidence

[email protected]

Credential file access: matched "KUBECONFIG"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 32,110Mainstream · −50% score
Versions published: 77Mature · −50% score
First published: Dec 2024
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes54,490

Previous version3.6.1

Published2026-05-14T22:58:52.332Z

SHA-256bb420fbdaf5c7d10505c5c5636b3890123b01ed5c71b97e1206a361c14fd6410

Why flagged

What the scanner saw

Credential file access: matched "KUBECONFIG"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

3h agoLast checked

reviewRisk

18Score

3.6.2Version

Status history (1 event)

new → available3h ago · risk review · score 18 · status changed

Evidence

Static findings

16 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Credential file access	package/dist/tools/exec_in_pod.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/helm-operations.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-apply.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-context.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-create.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-delete.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-describe.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-generic.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-get.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-logs.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-operations.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-patch.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-rollout.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/kubectl-scale.js	matched "KUBECONFIG"	30
high	Credential file access	package/dist/tools/node-management.js	matched "KUBECONFIG"	30
medium	Credential file access	package/dist/utils/kubernetes-manager.js	matched "kubeconfig"	10

Manifest

Package metadata

Scripts9

buildtsc && shx chmod +x dist/*.js
buildmcpbnode_modules/.bin/mcpb pack
chatnpx mcp-chat --server "./dist/index.js"
devtsc --watch
dockerbuilddocker buildx build -t flux159/mcp-server-kubernetes --platform linux/amd64,linux/arm64 --push .
prepublishOnlynpm run build
startnode dist/index.js
testvitest run
version:updatenode scripts/update-version.js

Dependencies12

@kubernetes/client-node1.3.0
@modelcontextprotocol/sdk1.26.0
@opentelemetry/api1.9.1
@opentelemetry/auto-instrumentations-node0.75.0
@opentelemetry/exporter-trace-otlp-grpc0.211.0
@opentelemetry/resources2.7.1
@opentelemetry/sdk-node0.217.0
@opentelemetry/semantic-conventions1.40.0
express4.21.2
js-yaml4.1.1
yaml2.8.3
zod3.25.76