PkgRadar

Package evidence

[email protected]

Credential file access: matched ".ssh"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherekrich
Artifact bytes2,177,268
Previous version0.0.3
Published2026-05-25T00:40:14.669Z
SHA-256850ae21ad504f4b8af9f01ebfca1b58c343b0535ee864c25a801c7ed0928c50f

Why flagged

What the scanner saw

Credential file access: matched ".ssh"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
135Score
0.0.4Version
Status history (1 event)
  1. newavailable · risk high · score 135 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

ekrich

4 members · evidence strength 84

Evidence

Static findings

27 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential file accesspackage/dist/ssh-config-DAsGgEig.mjsmatched ".ssh"30
mediumObfuscation Densitypackage/dist/blade-CKDp56sR.mjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/julia-B3gTKp-V.mjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/php-DcghqDXq.mjshigh encoded/escaped-token density12
Show all 27 findings (low-signal and informational)
SeverityKindPathDetailPoints
highCredential file accesspackage/dist/ssh-config-DAsGgEig.mjsmatched ".ssh"30
mediumObfuscation Densitypackage/dist/blade-CKDp56sR.mjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/julia-B3gTKp-V.mjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/php-DcghqDXq.mjshigh encoded/escaped-token density12
lowObfuscationpackage/dist/editor/dist/assets/index-B0kdJwfN.jsmatched "\\u00C0"3
lowObfuscationpackage/dist/ara-D-j-XXGW.mjsmatched "\\x7F"3
lowObfuscationpackage/dist/blade-CKDp56sR.mjsmatched "\\x7F"3
lowObfuscationpackage/dist/coffee-Cvl138sb.mjsmatched "fromCharCode"3
lowObfuscationpackage/dist/coq-BsUrCVvK.mjsmatched "\\xA0"3
lowObfuscationpackage/dist/crystal-JmPkQM3O.mjsmatched "\\x08"3
lowObfuscationpackage/dist/css-BacX8Aaf.mjsmatched "\\uFEFF"3
lowObfuscationpackage/dist/glimmer-js-Cuh-sLOS.mjsmatched "\\x08"3
lowObfuscationpackage/dist/glimmer-ts-Drh19V-_.mjsmatched "\\x08"3
lowObfuscationpackage/dist/hack-Csgj2aE9.mjsmatched "\\x7F"3
lowObfuscationpackage/dist/html-Bg4BDoLh.mjsmatched "\\x00"3
lowObfuscationpackage/dist/julia-B3gTKp-V.mjsmatched "\\x01"3
lowObfuscationpackage/dist/less-BmQG9s2A.mjsmatched "\\x00"3
lowObfuscationpackage/dist/php-DcghqDXq.mjsmatched "\\x7F"3
lowObfuscationpackage/dist/puppet-CjFnVLMe.mjsmatched "\\x7F"3
lowObfuscationpackage/dist/ruby-DLys19ma.mjsmatched "\\x00"3
lowObfuscationpackage/dist/scss-BOWWV2Ec.mjsmatched "\\x00"3
lowObfuscationpackage/dist/stata-R_35NCZA.mjsmatched "\\x00"3
lowObfuscationpackage/dist/stylus-CNLem3u-.mjsmatched "\\x00"3
lowObfuscationpackage/dist/twig-CgEsAzoI.mjsmatched "\\x7F"3
lowObfuscationpackage/dist/typst-D73qYMMw.mjsmatched "\\x00"3
lowObfuscationpackage/dist/vue-CPLUWs4f.mjsmatched "\\x00"3
lowObfuscationpackage/dist/wasm-DhFUmAQm.mjsmatched "atob("3

Manifest

Package metadata

Scripts5
  • buildvp pack && node ./scripts/copy-editor-files.mjs
  • checkvp check
  • devvp pack --watch
  • prepublishOnlyvp run build
  • testvp test
Dependencies14
  • @base-ui/react^1.4.1
  • @tailwindcss/vite^4.1.6
  • @vitejs/plugin-react^4.6.0
  • citty^0.2.2
  • class-variance-authority^0.7.1
  • clsx^2.1.1
  • jiti^2.4.2
  • lucide-react^1.16.0
  • react^19.1.0
  • react-dom^19.1.0
  • tailwind-merge^3.6.0
  • tailwindcss^4.1.6
  • tw-animate-css^1.4.0
  • vite^6.3.0