PkgRadar

Package evidence

[email protected]

Remote Dependency Spec: dependencies.secrets-passbolt="github:passbolt/secrets.js#v2.0.1"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
65Mature · −50% score
First published
Mar 2021
Publisher
cedric.alfonsi

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publishercedric.alfonsi
Artifact bytes1,414,492
Previous version5.11.1
Published2026-05-18T14:34:11.058Z
SHA-256e33d3496b66277c28441bff8ad4a885689fd12fb4d99ba7642327676fd1b38e4

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.secrets-passbolt="github:passbolt/secrets.js#v2.0.1"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
6Score
5.12.1Version
Status history (1 event)
  1. new → available · risk review · score 6 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Dependency Specpackage.jsondependencies.secrets-passbolt="github:passbolt/secrets.js#v2.0.1"12

Manifest

Package metadata

Scripts39
  • buildnpx grunt build
  • build:background-pagewebpack --config webpack.background-page.config.js
  • build:content-scriptsnpm run build:content-scripts:app; npm run build:content-scripts:browser-integration; npm run build:content-scripts:public-website
  • build:content-scripts:appwebpack --config webpack-content-scripts.config.js
  • build:content-scripts:browser-integrationwebpack --config webpack-content-scripts.browser-integration.config.js
  • build:content-scripts:public-websitewebpack --config webpack-content-scripts.public-website-sign-in.config.js
  • build:safari:background-pagewebpack --config webpack.safari-background-page.config.js
  • build:service-workerwebpack --config webpack.service-worker.config.js; webpack --config webpack-offscreens.config.js
  • build:web-accessible-resourcesnpm run build:web-accessible-resources:app; npm run build:web-accessible-resources:browser-integration
  • build:web-accessible-resources:appwebpack --config webpack-data.config.js; webpack --config webpack-data.download.config.js
  • build:web-accessible-resources:browser-integrationwebpack --config webpack-data.in-form-call-to-action.config.js; webpack --config webpack-data.in-form-menu.config.js
  • dev:build:background-pagewebpack --env debug=true --config webpack.background-page.config.js
  • dev:build:content-scriptsnpm run dev:build:content-scripts:app; npm run dev:build:content-scripts:browser-integration; npm run dev:build:content-scripts:public-website
  • dev:build:content-scripts:appwebpack --env debug=true --config webpack-content-scripts.config.js
  • dev:build:content-scripts:browser-integrationwebpack --env debug=true --config webpack-content-scripts.browser-integration.config.js
  • dev:build:content-scripts:public-websitewebpack --env debug=true --config webpack-content-scripts.public-website-sign-in.config.js
  • dev:build:safari:background-pagewebpack --env debug=true --config webpack.safari-background-page.config.js
  • dev:build:service-workerwebpack --env debug=true --config webpack.service-worker.config.js; webpack --env debug=true --config webpack-offscreens.config.js
  • dev:build:web-accessible-resourcesnpm run dev:build:web-accessible-resources:app; npm run dev:build:web-accessible-resources:browser-integration
  • dev:build:web-accessible-resources:appwebpack --env debug=true --config webpack-data.config.js; webpack --env debug=true --config webpack-data.download.config.js
  • dev:build:web-accessible-resources:browser-integrationwebpack --env debug=true --config webpack-data.in-form-call-to-action.config.js; webpack --env debug=true --config webpack-data.in-form-menu.config.js
  • dev:safari:buildgrunt build-safari-debug;
  • dev:safari:convertxcrun safari-web-extension-converter --app-name Passbolt-Safari-Extension --swift --macos-only --project-location ./build-safari-extension --bundle-identifier com.passbolt.safari-extension --force --no-open build/all/
  • dev:watch:build:background-pagenpm run dev:build:background-page -- -w
  • dev:watch:build:content-scripts:appnpm run dev:build:content-scripts:app -- -w
  • dev:watch:build:content-scripts:browser-integrationnpm run dev:build:content-scripts:browser-integration -- -w
  • dev:watch:build:content-scripts:public-websitenpm run dev:build:content-scripts:public-website -- -w
  • dev:watch:build:service-workernpm run dev:build:service-worker -- -w
  • dev:watch:build:web-accessible-resources:appnpm run dev:build:web-accessible-resources:app -- -w
  • dev:watch:build:web-accessible-resources:browser-integrationnpm run dev:build:web-accessible-resources:browser-integration -- -w
  • …and 9 more.
Dependencies18
  • await-lock^2.1.0
  • downloadjs^1.4.7
  • eckey-utils^0.7.14
  • i18next^25.4.0
  • i18next-http-backend^3.0.5
  • ip-regex^5.0.0
  • jssha~3.3.1
  • kdbxweb2.1.1
  • openpgp^6.1.1
  • papaparse^5.5.2
  • passbolt-styleguide^5.12.1
  • react^18.3.1
  • react-dom^18.3.1
  • secrets-passboltgithub:passbolt/secrets.js#v2.0.1
  • uuid^14.0.0
  • validator^13.15.26
  • webextension-polyfill^0.10.0
  • xregexp~5.1.2