Package evidence

[email protected]

Remote Payload: matched "api.telegram.org/bot"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 1
First published: Jun 2026
Publisher: oneie

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisheroneie

Artifact bytes13,413,006

Previous versionnone

Published2026-06-14T04:30:51.990Z

SHA-256ae5e0e974f883cff0d2b2aec1fda424b2ef17c120d65e2213b1ecc528282aafd

Why flagged

What the scanner saw

Remote Payload: matched "api.telegram.org/bot"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

4h agoLast checked

reviewRisk

29Score

0.1.0Version

Status history (1 event)

new → available4h ago · risk review · score 29 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/src/lib/channels.ts	matched "api.telegram.org/bot"	12
medium	Remote Payload	package/src/pages/api/agents/sync-from-git.ts	matched "raw.githubusercontent.com"	12

Show all 3 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/src/lib/channels.ts	matched "api.telegram.org/bot"	12
medium	Remote Payload	package/src/pages/api/agents/sync-from-git.ts	matched "raw.githubusercontent.com"	12
low	Messenger Bot Endpoint	package/src/lib/channels.ts	matched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)	5

Manifest

Package metadata

Scripts27

buildbun run gen:playbook-meta && (cd ../../packages/sdk && bun run build) && NODE_ENV=production astro build && node scripts/patch-wrangler-json.mjs
checkastro check
db:migrate:localfor f in $(ls migrations/*.sql | sort); do bunx wrangler d1 execute one-owners --local --file=$f; done
db:seed:localbunx wrangler d1 execute one-owners --local --file=scripts/seed-local.sql
demo:crmbash scripts/demo-crm.sh
demo:crm:cbash scripts/demo-crm.sh
demo:tenancybash scripts/demo-tenancy.sh
deploynpm run build && wrangler deploy --env production
devbun run gen:playbook-meta && astro dev
dev:bgmkdir -p .dev && (astro dev > .dev/astro.log 2>&1 & echo $! > .dev/astro.pid)
dev:fullbun run dev:gateway:bg && bun run dev
dev:gatewaybun run scripts/local-gateway.ts
dev:gateway:bgmkdir -p .dev && (bun run scripts/local-gateway.ts > .dev/gateway.log 2>&1 & echo $! > .dev/gateway.pid)
dev:gateway:stop[ -f .dev/gateway.pid ] && kill $(cat .dev/gateway.pid) 2>/dev/null; rm -f .dev/gateway.pid
dev:stop[ -f .dev/astro.pid ] && kill $(cat .dev/astro.pid) 2>/dev/null; rm -f .dev/astro.pid
dev:wranglernpm run build && wrangler dev --config dist/server/wrangler.json --persist-to .wrangler/state --port 8787 --ip 127.0.0.1
gen:playbook-metabun run scripts/generate-playbook-meta.ts
hooks:installbash scripts/install-hooks.sh
prebuildnode scripts/hash-widget.mjs
previewastro preview
testvitest run
test:e2e:pwplaywright test
test:e2e:pw:debugplaywright test --debug
test:e2e:pw:uiplaywright test --ui
test:watchvitest
typechecktsc --noEmit
verify(cd ../../packages/sdk && bun run build) && bun run typecheck && bun run test

Dependencies71

@100mslive/roomkit-react^0.5.2
@ai-sdk/groq^3.0.38
@ai-sdk/openai-compatible^2.0.45
@ai-sdk/react^3.0.176
@astro-community/astro-embed-youtube^0.5.10
@astrojs/cloudflare^13.3.1
@astrojs/node^10.0.6
@astrojs/react^5.0.4
@better-auth/kysely-adapter^1.6.11
@cloudflare/vite-plugin^1.35.0
@composio/core^0.10.0
@composio/vercel^0.9.2
@cspotcode/source-map-support^0.8.1
@fontsource-variable/geist^5.2.8
@mux/mux-player-react^3.13.0
@mysten/dapp-kit^1.0.6
@mysten/sui^2.16.0
@nanostores/react^1.1.0
@oneie/sdkfile:../../packages/sdk
@radix-ui/react-use-controllable-state^1.2.2
@rive-app/react-webgl2^4.28.3
@scure/bip39^2.2.0
@simplewebauthn/browser^13.3.0
@simplewebauthn/server^13.3.0
@stripe/react-stripe-js^6.3.0
@stripe/stripe-js^9.4.0
@tailwindcss/typography^0.5.19
@tailwindcss/vite^4.0.0
@tiptap/core^3.23.5
@tiptap/react^3.23.5
…and 41 more.