Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Versions published
- 145
- First published
- Apr 2026
- Publisher
- reasonix
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Credential file access: matched ".azure"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (2 events)
- available → available · risk review · score 239 · status available -> available, risk high -> review, score 412 -> 239
- new → available · risk high · score 412 · status changed
Related candidates
Linked campaigns and clusters
reasonix
3 members · evidence strength 74Install Lifecycle Suppresses Failure — prepare="simple-git-hooks || true"
4 members · evidence strength 87Evidence
Static findings
59 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/dist/cli/chunk-J2IHQGPQ.js | matched ".azure" | 30 |
| high | Credential file access | package/dist/index.js | matched ".azure" | 30 |
| medium | Remote Payload | package/dashboard/dist/app.js | matched "wget " | 12 |
| medium | Remote Payload | package/dist/cli/chunk-FEZK652I.js | matched "cUrl " | 12 |
| medium | Obfuscation Density | package/dist/cli/chunk-MQWO32ZD.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/cli/chunk-WMTMMSXU.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/cli/chunk-ZWHSHFDP.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/cli/commands-DRHFCYMO.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/index.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/dist/cli/chunk-QF32ROX2.js | 2671491 bytes | 10 |
Show all 59 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/dist/cli/chunk-J2IHQGPQ.js | matched ".azure" | 30 |
| high | Credential file access | package/dist/index.js | matched ".azure" | 30 |
| medium | Remote Payload | package/dashboard/dist/app.js | matched "wget " | 12 |
| medium | Remote Payload | package/dist/cli/chunk-FEZK652I.js | matched "cUrl " | 12 |
| medium | Obfuscation Density | package/dist/cli/chunk-MQWO32ZD.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/cli/chunk-WMTMMSXU.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/cli/chunk-ZWHSHFDP.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/cli/commands-DRHFCYMO.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/index.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/dist/cli/chunk-QF32ROX2.js | 2671491 bytes | 10 |
| low | Credential file access | package/dist/cli/chunk-ZWHSHFDP.js | matched ".ssh" | 5 |
| low | Obfuscation | package/dist/cli/acp-WFQIC6SO.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dashboard/dist/app.js | matched "\\x20" | 3 |
| low | Obfuscation | package/dist/cli/chunk-23ZPCIPR.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/chunk-25T6CVUP.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/cli/chunk-3ZZXQ3CZ.js | matched "\\u2500" | 3 |
| low | Obfuscation | package/dist/cli/chunk-6OWJV3YW.js | matched "\\uFF5C" | 3 |
| low | Obfuscation | package/dist/cli/chunk-7AST3QQ3.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/chunk-ASOLXV67.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/chunk-AWEULQG6.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/cli/chunk-DFX5ZH5L.js | matched "\\u2260" | 3 |
| low | Obfuscation | package/dist/cli/chunk-EQATK2L2.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/chunk-GNS7BAT2.js | matched "\\u21BB" | 3 |
| low | Obfuscation | package/dist/cli/chunk-HIYTRCSW.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/chunk-JNTMOX7G.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/cli/chunk-LGEKVMMV.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/dist/cli/chunk-MGTBP7GG.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/chunk-MQWO32ZD.js | matched "\\uD800" | 3 |
| low | Obfuscation | package/dist/cli/chunk-O5LIHAMP.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/chunk-PB3MAFEI.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/cli/chunk-PLHAZOLZ.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/chunk-PXBQ6IZ7.js | matched "\\u25CF" | 3 |
| low | Obfuscation | package/dist/cli/chunk-Q46B3Z7H.js | matched "\\x20" | 3 |
| low | Obfuscation | package/dist/cli/chunk-RRXUIPWG.js | matched "\\u4e00" | 3 |
| low | Obfuscation | package/dist/cli/chunk-S4XVGLRW.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/dist/cli/chunk-SZ5XES2N.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/chunk-TAIKVL35.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/cli/chunk-TEDWJKEI.js | matched "\\u25B8" | 3 |
| low | Obfuscation | package/dist/cli/chunk-U5XQDCK7.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/chunk-W46ZMNKO.js | matched "\\x1B" | 3 |
| low | Obfuscation | package/dist/cli/chunk-WMTMMSXU.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist/cli/chunk-YEF7C4XI.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/chunk-ZWHSHFDP.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/dist/cli/chunk-ZZM6QJ4W.js | matched "\\u25B8" | 3 |
| low | Obfuscation | package/dist/cli/commands-DRHFCYMO.js | matched "\\u2717" | 3 |
| low | Obfuscation | package/dist/cli/commit-AG5KB4YP.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/desktop-JGL6GORA.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/cli/diff-4Z7ETWZO.js | matched "\\u2605" | 3 |
| low | Obfuscation | package/dist/cli/events-VRYXOSKI.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/index.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/index.js | matched "\\u25C7" | 3 |
| low | Obfuscation | package/dist/cli/mcp-browse-C3GXVMYZ.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/cli/mcp-inspect-ZMYUNFDS.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/mcp-LZO4HXFA.js | matched "\\u25B8" | 3 |
| low | Obfuscation | package/dist/cli/replay-4TP7ZUMZ.js | matched "\\u25B0" | 3 |
| low | Obfuscation | package/dist/cli/run-6MXQYBOE.js | matched "\\u203A" | 3 |
| low | Obfuscation | package/dist/cli/server-Z3IMJNNI.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/cli/sessions-NXQ5SAV7.js | matched "\\u2500" | 3 |
| low | Obfuscation | package/dist/cli/setup-LHZELI6I.js | matched "\\u7B80" | 3 |
Manifest
Package metadata
Scripts14
buildtsup && node scripts/copy-dashboard-vendor-css.mjs && node scripts/copy-tree-sitter-grammars.mjschattsx src/cli/index.ts chatdevtsx src/cli/index.tsformatbiome format --write src testslintbiome check src testslint:fixbiome check --write src testspreparesimple-git-hooks || trueprepublishOnlynpm run lint && npm run typecheck && npm run test && npm run buildtestvitest runtest:coveragevitest run --coveragetest:mutationstryker runtest:watchvitesttypechecktsc --noEmit && tsc --noEmit -p dashboardverifynpm run build && npm run lint && npm run typecheck && npm run test --silent
Dependencies15
cli-highlight^2.1.11commander^12.1.0eventsource-parser^3.0.0iconv-lite^0.7.2ignore^7.0.5ink^7.0.2ink-text-input^6.0.0node-html-parser^7.1.0picomatch^4.0.4react^19.2.6string-width^7.2.0undici^8.2.0web-tree-sitter^0.26.9ws^8.20.1zod^4.4.1