PkgRadar

Package evidence

[email protected]

Credential file access: matched "AWS_ACCESS_KEY"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
55Mature · −50% score
First published
May 2025
Publisher
lhypds

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherlhypds
Artifact bytes1,048,802
Previous version0.1.57
Published2026-04-24T17:44:37.596Z
SHA-256987670a0cc65ffdb6f0849f124b2b4478c76c3fb7874c8a331dea52d08daf7c6

Why flagged

What the scanner saw

Credential file access: matched "AWS_ACCESS_KEY"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
15Score
0.1.58Version
Status history (1 event)
  1. new → available · risk review · score 15 · status changed

Evidence

Static findings

6 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 6 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/pages/api/user/add.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/utils/awsUtils.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/pages/api/user/update/email-subscription.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/pages/api/user/update/email.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/pages/api/user/reset-password.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/pages/api/user/update/role.jsmatched "AWS_ACCESS_KEY"5

Manifest

Package metadata

Scripts3
  • buildnext build
  • devnext dev
  • startnext start
Dependencies44
  • @aws-sdk/client-s3^3.990.0
  • @aws-sdk/client-ses^3.990.0
  • @aws-sdk/s3-request-presigner^3.990.0
  • @modelcontextprotocol/sdk^1.11.0
  • @paypal/checkout-server-sdk^1.0.3
  • @paypal/react-paypal-js^8.1.3
  • axios^1.7.9
  • chalk^5.2.0
  • cors^2.8.5
  • csv^6.3.0
  • csv-writer^1.6.0
  • eslint-config-next^16.1.6
  • express^5.1.0
  • fetch-cookie^3.1.0
  • form-data^4.0.0
  • highlight.js^11.9.0
  • i18next^25.1.1
  • i18next-browser-languagedetector^8.1.0
  • i18next-http-backend^3.0.2
  • image-size^1.1.0
  • jsonwebtoken^9.0.2
  • katex^0.16.9
  • mammoth^1.6.0
  • moment^2.29.4
  • moment-timezone^0.5.43
  • mysql2^3.17.1
  • nearby-cities^1.1.0
  • next^15.5.12
  • next-pwa^5.6.0
  • node-fetch^3.3.2
  • …and 14 more.