Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Publisher
- GitHub ActionsTrusted automation · −70% score
Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Credential file access: matched "GITHUB_TOKEN"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 210 · status changed
Evidence
Static findings
17 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/scripts/update-translations.sh | matched "GITHUB_TOKEN" | 30 |
| medium | Remote Payload | package/editor/interface/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.annual-report-2020-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.annual-report-2021-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.cookies-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.dmca-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.download-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.faq-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.general-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.preview-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.privacypolicy-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.scratch_14-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.studio-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.teacher-faq-l10njson/cy.json | matched "iwr " | 12 |
| medium | Large Javascript Payload | package/locales/editor-msgs.js | 4835617 bytes | 10 |
| medium | Large Javascript Payload | package/locales/interface-msgs.js | 3693704 bytes | 10 |
Show all 17 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Credential file access | package/scripts/update-translations.sh | matched "GITHUB_TOKEN" | 30 |
| medium | Remote Payload | package/editor/interface/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.annual-report-2020-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.annual-report-2021-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.cookies-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.dmca-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.download-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.faq-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.general-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.preview-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.privacypolicy-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.scratch_14-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.studio-l10njson/cy.json | matched "iwr " | 12 |
| medium | Remote Payload | package/www/scratch-website.teacher-faq-l10njson/cy.json | matched "iwr " | 12 |
| medium | Large Javascript Payload | package/locales/editor-msgs.js | 4835617 bytes | 10 |
| medium | Large Javascript Payload | package/locales/interface-msgs.js | 3693704 bytes | 10 |
| low | Install-time lifecycle script | package.json | prepare="husky install" | 4 |
Manifest
Package metadata
Scripts27
buildnpm run clean && npm run build:data && webpack --progress --colors --bailbuild:data./scripts/build-data.mtscleanrimraf ./dist ./locales && mkdirp dist localesformatprettier --write . && eslint --fixlintnpm run lint:js && npm run lint:jsonlint:jseslint && prettier --check .lint:jsonjshint -e .json www editor/blocks editor/extensions editor/interface editor/paint-editorpreparehusky installpull:blocks./scripts/tx-pull-editor.mts scratch-editor blocks ./editor/blocks/pull:editornpm run pull:blocks && npm run pull:extensions && npm run pull:paint && npm run pull:interfacepull:extensions./scripts/tx-pull-editor.mts scratch-editor extensions ./editor/extensions/pull:helpnpm run pull:help:names && npm run pull:help:articlespull:help:articles./scripts/tx-pull-help-articles.mtspull:help:names./scripts/tx-pull-help-names.mtspull:interface./scripts/tx-pull-editor.mts scratch-editor interface ./editor/interface/pull:paint./scripts/tx-pull-editor.mts scratch-editor paint-editor ./editor/paint-editor/pull:www./scripts/tx-pull-www.mts ./wwwpush:help./scripts/tx-push-help.mtssync:helpnpm run push:help && npm run pull:helptestnpm run lint:js && npm run validate:editor && npm run validate:www && npm run build && npm run lint:jsonupdatescripts/update-translations.shvalidate:blocks./scripts/validate-translations.mts ./editor/blocks/validate:editornpm run validate:blocks && npm run validate:extensions && npm run validate:interface && npm run validate:paintvalidate:extensions./scripts/validate-translations.mts ./editor/extensions/ && ./scripts/validate-extension-inputs.mtsvalidate:interface./scripts/validate-translations.mts ./editor/interface/validate:paint./scripts/validate-translations.mts ./editor/paint-editor/validate:www./scripts/validate-www.mts ./www
Dependencies8
@transifex/api7.1.6async3.2.6format-message-parse6.2.4glob7.2.3lodash.defaultsdeep4.6.1mkdirp3.0.1transifex1.6.6tsx4.22.3