PkgRadar

Package evidence

[email protected]

Credential file access: matched "GOOGLE_APPLICATION_CREDENTIALS"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
150
Versions published
2
First published
Jun 2026
Publisher
error51

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publishererror51
Artifact bytes1,132,239
Previous version1.0.6
Published2026-06-14T03:03:15.669Z
SHA-256c2aad7ce85661b963c40194fd1e441fe2d6c54eb702f84b91ceb686a84b97638

Why flagged

What the scanner saw

Credential file access: matched "GOOGLE_APPLICATION_CREDENTIALS"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
5Score
1.0.7Version
Status history (1 event)
  1. new → available · risk review · score 5 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowCredential file accesspackage/dist/cloud/deployment.jsmatched "GOOGLE_APPLICATION_CREDENTIALS"5

Manifest

Package metadata

Scripts27
  • buildtsc -p tsconfig.lib.json
  • build:appnode src/database/sqlite/download-wasm.mjs && tsc && node -e "const fs=require('fs');const p=require('path');const s='src/database/sqlite';const d='dist/src/database/sqlite';fs.mkdirSync(d,{recursive:true});for(const f of ['sqlite3.wasm','sqlite3-node.mjs'])fs.copyFileSync(p.join(s,f),p.join(d,f));"
  • cleannode -e "require('fs').rmSync('dist',{recursive:true,force:true})"
  • coveragec8 node --test --test-force-exit dist/tests/integration.test.js dist/tests/memory-leak.test.js dist/tests/wire-protocol.test.js dist/src/tests/diagnostics.test.js dist/src/tests/schema-inspector.test.js dist/src/tests/security-headers.test.js dist/src/tests/channels.test.js
  • devtsc && node dist/main.js
  • linttsc --noEmit
  • migratenode dist/main.js migrate
  • postbuildnode -e "const fs=require('fs');const p=require('path');const s='src/database/sqlite';const d='dist/database/sqlite';fs.mkdirSync(d,{recursive:true});for(const f of ['sqlite3.wasm','sqlite3-node.mjs'])fs.copyFileSync(p.join(s,f),p.join(d,f));"
  • prebuildnode src/database/sqlite/download-wasm.mjs
  • prepublishOnlynpm run clean && npm run build && npm run lint && npm run verify:pack
  • startnode dist/main.js
  • testnode --test dist/tests/integration.test.js
  • test:chaostsc && node --test dist/tests/system/chaos-testing.test.js
  • test:fuzztsc && node --test dist/tests/system/fuzz-testing.test.js
  • test:infratsc && node --test dist/tests/system/infrastructure.test.js
  • test:loadtsc && node --test dist/tests/system/load-testing.test.js
  • test:memorytsc && node --test dist/tests/system/memory-safety.test.js
  • test:migrationnpm run build && npm run build:app && node --test --test-force-exit dist/tests/package-migration.test.js
  • test:runtsc && node --test dist/tests/integration.test.js
  • test:securitytsc && node --test dist/tests/system/security.test.js
  • test:systemtsc && node dist/tests/system/runner.js
  • test:system:citsc && node dist/tests/system/runner.js --ci --json --skip-pg
  • verify:packnode ../../scripts/verify-package.mjs
  • verify:wasmnode src/database/sqlite/download-wasm.mjs --verify
  • version:majornpm version major --no-git-tag-version
  • version:minornpm version minor --no-git-tag-version
  • version:patchnpm version patch --no-git-tag-version
Dependencies3
  • reflect-metadata^0.2.2
  • ws^8.18.0
  • zod^4.4.3