PkgRadar

Package evidence

[email protected]

Credential File Packaged: package/examples/multi-tenant/.npmrc

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
433,752Ubiquitous · −70% score
Versions published
1,811Mature · −50% score
First published
Feb 2015
Publisher
elliotpayload

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherelliotpayload
Artifact bytes13,726,585
Previous version1.15.10
Published2025-03-10T19:17:36.460Z
SHA-256e31abb6b3f99d6fb1d8ced5b911be83591f9c4b805f228aeb90265df9aef439c

Why flagged

What the scanner saw

Credential File Packaged: package/examples/multi-tenant/.npmrc

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
30Score
1.15.11Version
Status history (1 event)
  1. new → available · risk review · score 30 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential File Packagedpackage/examples/multi-tenant/.npmrcpackage/examples/multi-tenant/.npmrc35
highCredential File Packagedpackage/examples/virtual-fields/.npmrcpackage/examples/virtual-fields/.npmrc35
highCredential File Packagedpackage/examples/whitelabel/.npmrcpackage/examples/whitelabel/.npmrc35
highCredential File Packagedpackage/examples/form-builder/cms/.npmrcpackage/examples/form-builder/cms/.npmrc35
highCredential File Packagedpackage/examples/redirects/cms/.npmrcpackage/examples/redirects/cms/.npmrc35

Manifest

Package metadata

Scripts13
  • buildcross-env NODE_ENV=production yarn build:payload && yarn build:server && yarn copyfiles && yarn build:next
  • build:nextcross-env PAYLOAD_CONFIG_PATH=dist/payload/payload.config.js NEXT_BUILD=true node dist/server.js
  • build:payloadcross-env PAYLOAD_CONFIG_PATH=src/payload/payload.config.ts payload build
  • build:servertsc --project tsconfig.server.json
  • copyfilescopyfiles -u 1 "src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png}" dist/
  • devcross-env PAYLOAD_CONFIG_PATH=src/payload/payload.config.ts nodemon
  • ejectyarn remove next react react-dom @next/eslint-plugin-next && ts-node eject.ts
  • generate:graphQLSchemaPAYLOAD_CONFIG_PATH=src/payload/payload.config.ts payload generate:graphQLSchema
  • generate:typescross-env PAYLOAD_CONFIG_PATH=src/payload/payload.config.ts payload generate:types
  • linteslint src
  • lint:fixeslint --fix --ext .ts,.tsx src
  • seedrm -rf media && cross-env PAYLOAD_SEED=true PAYLOAD_DROP_DATABASE=true PAYLOAD_CONFIG_PATH=src/payload/payload.config.ts ts-node src/server.ts
  • servecross-env PAYLOAD_CONFIG_PATH=dist/payload/payload.config.js NODE_ENV=production node dist/server.js
Dependencies14
  • @payloadcms/plugin-cloud^2.0.0
  • @payloadcms/plugin-form-builder^1.0.13
  • @payloadcms/plugin-nested-docs^1.0.4
  • @payloadcms/plugin-redirects^1.0.0
  • @payloadcms/plugin-seo^1.0.10
  • cross-env^7.0.3
  • dotenv^8.2.0
  • express^4.17.1
  • next^13.4.8
  • payloadlatest
  • payload-admin-bar^1.0.6
  • react^18.2.0
  • react-dom^18.2.0
  • react-hook-form^7.45.1