Package evidence

[email protected]

Credential file access: matched "GOOGLE_APPLICATION_CREDENTIALS"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 299
Versions published: 33
First published: Feb 2026
Publisher: markmhendrickson

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publishermarkmhendrickson

Artifact bytes2,703,074

Previous version0.14.0

Published2026-05-29T16:54:07.959Z

SHA-2560ad8de2f9c7ee6876233ff2453670cf1833839969be022072ffa60b53fd50954

Why flagged

What the scanner saw

Credential file access: matched "GOOGLE_APPLICATION_CREDENTIALS"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

19d agoLast checked

reviewRisk

5Score

0.15.0Version

Status history (1 event)

new → available19d ago · risk review · score 5 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Credential file access	package/dist/cli/index.js	matched "GOOGLE_APPLICATION_CREDENTIALS"	5

Manifest

Package metadata

Scripts192

analyze:schemasnode scripts/analyze-data-dir-schemas.js
backfill:timelinetsx scripts/backfill_timeline_via_recompute.ts
branches:prunenode scripts/prune-merged-branches.js
buildnpm run build:server
build:docsvite build --config vite.config.ts
build:inspectornode scripts/build_inspector.js
build:inspector:dev-targetcross-env VITE_PUBLIC_BASE_PATH=/inspector/ NEOTOMA_INSPECTOR_OUT_DIR=../dist/inspector VITE_NEOTOMA_ENV=dev npm --prefix inspector run build
build:inspector:prod-targetcross-env VITE_PUBLIC_BASE_PATH=/inspector/ NEOTOMA_INSPECTOR_OUT_DIR=../dist/inspector VITE_NEOTOMA_ENV=prod npm --prefix inspector run build
build:inspector:watch-targetnpm run build:inspector:dev-target
build:inspector:watch-target:prodnpm run build:inspector:prod-target
build:pages:sitenpm run build:site:pages
build:scriptstsc -p tsconfig.scripts.json
build:servertsc && node scripts/copy_pdf_worker_wrapper.js && npm run build:scripts
build:site:pagestsx --tsconfig frontend/tsconfig.json scripts/build_github_pages_site.tsx
build:uivite build --config vite.config.ts
check:bundlephobianode scripts/check_bundlephobia.js
check:pw-coveragetsx scripts/check-playwright-coverage.ts
check:snapshotstsx scripts/check_stale_snapshots.ts
check:timelinetsx scripts/check_timeline_health.ts
clinode dist/cli/index.js
cli:devtsx src/cli/index.ts
copy:envnode scripts/colpy-env-to-worktree.js
debug:errors:clinode scripts/trigger_error_debug_cli.js
devnpm run build:inspector:dev-target && node scripts/pick-port.js --print-resources 3080 5195 3001 -- cross-env NEOTOMA_INSPECTOR_LIVE_BUILD=1 npx concurrently --kill-others-on-fail=false --restart-tries=0 --timestamp='HH:mm:ss' --prefix='{time} [{name}]' --prefix-colors='blue,green,magenta,yellow,cyan' --names='server,app ,types ,links ,insp ' 'npm run dev:server' 'npm run dev:ui' 'npm run dev:types' 'npm run dev:links' 'npm run dev:inspector'
dev:apinpm run dev:server:tunnel
dev:docsvite --config vite.config.ts
dev:docs:servenode scripts/serve-docs-react.js
dev:fullnpm run dev
dev:full:prodnpm run build:inspector:prod-target && node scripts/pick-port.js --print-resources 3180 5295 3101 -- cross-env NEOTOMA_ENV=production NEOTOMA_INSPECTOR_LIVE_BUILD=1 npx concurrently --kill-others-on-fail=false --restart-tries=0 --timestamp='HH:mm:ss' --prefix='{time} [{name}]' --prefix-colors='blue,green,magenta,yellow,cyan' --names='server,app ,types ,links ,insp ' 'npm run dev:server' 'npm run dev:ui' 'npm run dev:types' 'npm run dev:links' 'npm run dev:inspector:prod'
dev:inspectorcross-env VITE_PUBLIC_BASE_PATH=/inspector/ NEOTOMA_INSPECTOR_OUT_DIR=../dist/inspector VITE_NEOTOMA_ENV=dev npm --prefix inspector run build:watch
…and 162 more.

Dependencies68

@hellocoop/httpsig^1.4.0
@hookform/resolvers^5.2.2
@modelcontextprotocol/sdk^1.29.0
@noble/curves^2.0.1
@noble/hashes^2.0.1
@radix-ui/react-accordion^1.2.12
@radix-ui/react-avatar^1.1.11
@radix-ui/react-checkbox^1.3.3
@radix-ui/react-collapsible^1.1.12
@radix-ui/react-dialog^1.1.15
@radix-ui/react-dropdown-menu^2.0.6
@radix-ui/react-label^2.1.8
@radix-ui/react-navigation-menu^1.2.14
@radix-ui/react-popover^1.1.15
@radix-ui/react-progress^1.1.8
@radix-ui/react-scroll-area^1.2.10
@radix-ui/react-select^2.0.0
@radix-ui/react-separator^1.1.8
@radix-ui/react-slot^1.2.4
@radix-ui/react-switch^1.2.6
@radix-ui/react-tabs^1.1.13
@radix-ui/react-toast^1.1.5
@radix-ui/react-tooltip^1.2.8
@sqlite.org/sqlite-wasm^3.51.1-build1
@tanstack/react-table^8.21.3
@types/react-syntax-highlighter^15.5.13
apache-arrow^21.1.0
better-sqlite3^12.6.2
class-variance-authority^0.7.1
clsx^2.1.0
…and 38 more.