PkgRadar

Package evidence

[email protected]

Remote Dependency Spec: dependencies.secrets-passbolt="github:passbolt/secrets.js#v2.0.1"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
65Mature · −50% score
First published
Mar 2021
Publisher
cedric.alfonsi

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publishercedric.alfonsi
Artifact bytes1,391,588
Previous version5.12.1
Published2026-06-04T10:52:50.732Z
SHA-2563fd16c9d8d00446cdab635d49e431327087c54300ba49b9ee606526c1db80577

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.secrets-passbolt="github:passbolt/secrets.js#v2.0.1"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
6Score
5.13.0-alpha.1Version
Status history (1 event)
  1. new → available · risk review · score 6 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Dependency Specpackage.jsondependencies.secrets-passbolt="github:passbolt/secrets.js#v2.0.1"12

Manifest

Package metadata

Scripts22
  • buildwebpack
  • build:chromium-mv2webpack --config webpack.chromium-mv2.config.js
  • build:chromium-mv3webpack --config webpack.chromium-mv3.config.js
  • build:firefoxwebpack --config webpack.firefox.config.js
  • build:safariwebpack --config webpack.safari.config.js
  • dev:build:chromium-mv2NODE_ENV=development webpack --config webpack.chromium-mv2.config.js
  • dev:build:chromium-mv3NODE_ENV=development webpack --config webpack.chromium-mv3.config.js
  • dev:build:firefoxNODE_ENV=development webpack --config webpack.firefox.config.js
  • dev:build:safariNODE_ENV=development webpack --config webpack.safari.config.js
  • dev:safari:convertxcrun safari-web-extension-converter --app-name Passbolt-Safari-Extension --swift --macos-only --project-location ./build-safari-extension --bundle-identifier com.passbolt.safari-extension --force --no-open build/all/
  • dev:watch:build:chromium-mv2npm run dev:build:chromium-mv2 -- -w
  • dev:watch:build:chromium-mv3npm run dev:build:chromium-mv3 -- -w
  • dev:watch:build:firefoxnpm run dev:build:firefox -- -w
  • dev:watch:build:safarinpm run dev:build:safari -- -w
  • lintnpm run lint:lockfile && npm run lint:eslint
  • lint:eslinteslint src --max-warnings 0
  • lint:eslint-fixeslint --fix src
  • lint:lockfilelockfile-lint --path package-lock.json --allowed-hosts npm github.com --allowed-schemes "https:" "git+ssh:" --empty-hostname false --allowed-urls "[email protected]@"
  • testnpm run test:unit
  • test:ci:coveragenpm run test:coverage -- --runInBand
  • test:coveragejest --no-cache ./src/all/ ./src/chrome-mv3/ ./src/safari/ --coverage
  • test:unitjest --no-cache ./src/all/ ./src/chrome-mv3/ ./src/chrome/ ./src/safari/
Dependencies18
  • await-lock^2.1.0
  • downloadjs^1.4.7
  • eckey-utils^0.7.14
  • i18next^25.4.0
  • i18next-http-backend^3.0.5
  • ip-regex^5.0.0
  • jssha~3.3.1
  • kdbxweb2.1.1
  • openpgp^6.1.1
  • papaparse^5.5.2
  • passbolt-styleguide^5.13.0-alpha.6
  • react^18.3.1
  • react-dom^18.3.1
  • secrets-passboltgithub:passbolt/secrets.js#v2.0.1
  • uuid^14.0.0
  • validator^13.15.26
  • webextension-polyfill^0.10.0
  • xregexp~5.1.2