Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Known Indicator Filename: package/dist/core/secrets/bundle.js
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 303 · status changed
Related candidates
Linked campaigns and clusters
Known Indicator Filename — package/dist/core/secrets/bundle.js
2 members · evidence strength 70christianmarcschmidt
2 members · evidence strength 64Evidence
Static findings
42 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/dist/core/secrets/bundle.js | package/dist/core/secrets/bundle.js | 45 |
| high | Credential file access | package/dist/web/_app/immutable/chunks/BJ1WyX5l.js | matched ".azure" | 30 |
| high | Credential file access | package/dist/utils/git.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/dist/agent/tools/graph-tools.js | matched ".ssh" | 30 |
| medium | Remote Payload | package/dist/server/routes/r2-api.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dist/services/assets/r2-sync.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dist/cli/commands/r2.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dist/services/assets/r2.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dist/mcp/server.js | matched "curl " | 12 |
| medium | Remote Payload | package/dist/core/workspace-manager.js | matched "cUrl " | 12 |
Show all 42 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/dist/core/secrets/bundle.js | package/dist/core/secrets/bundle.js | 45 |
| high | Credential file access | package/dist/web/_app/immutable/chunks/BJ1WyX5l.js | matched ".azure" | 30 |
| high | Credential file access | package/dist/utils/git.js | matched "GITHUB_TOKEN" | 30 |
| high | Credential file access | package/dist/agent/tools/graph-tools.js | matched ".ssh" | 30 |
| medium | Remote Payload | package/dist/server/routes/r2-api.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dist/services/assets/r2-sync.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dist/cli/commands/r2.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dist/services/assets/r2.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dist/mcp/server.js | matched "curl " | 12 |
| medium | Remote Payload | package/dist/core/workspace-manager.js | matched "cUrl " | 12 |
| low | Obfuscation | package/dist/web/_app/immutable/nodes/2.x3yEhnol.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/nodes/3.CkgtaaDz.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/services/assets/base.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/BJ1WyX5l.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/services/bookmark-import-service.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/Bsokmj9K.js | matched "\\uFE0F" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/BT3KAag_.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/CA-SSsmA2.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist/server/routes/chat.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/CI0x_Zvz2.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/ClfZwNp32.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/Cn4uWvXa.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/cli/colors.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/core/comment-anchor.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/CW-tcm9w.js | matched "\\xA1" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/D25CpUpa.js | matched "\\ufe00" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/DNLox5BN2.js | matched "\\u00a0" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/DqZmeWn2.js | matched "atob(" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/eJNbcV2s.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/core/secrets/encryption.js | matched "Buffer.from(b64, 'base64" | 3 |
| low | Obfuscation | package/dist/cli/commands/admin/folder.js | matched "\\u2500" | 3 |
| low | Obfuscation | package/dist/cli/commands/folder.js | matched "\\u2500" | 3 |
| low | Obfuscation | package/dist/services/git.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist/server/routes/graph-api.js | matched "\\u201C" | 3 |
| low | Obfuscation | package/dist/services/import-service.js | matched "Buffer.from(content, 'base64" | 3 |
| low | Obfuscation | package/dist/cli/index.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/cli/commands/join.js | matched "\\u2022" | 3 |
| low | Obfuscation | package/dist/core/secrets/master-key.js | matched "Buffer.from(trimmed, 'base64" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/sEj1Ztgn.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/web/_app/immutable/chunks/soMdXAIS.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/cli/commands/start.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/mcp/state-signer.js | matched "Buffer.from(state, 'base64" | 3 |
Manifest
Package metadata
Scripts11
buildnode --max-old-space-size=8192 node_modules/typescript/bin/tsc && mkdir -p dist/agent/prompts dist/agent/skills && cp src/agent/prompts/*.md dist/agent/prompts/ && cp -r src/agent/skills/* dist/agent/skills/build:allnpm run build && npm run build:webbuild:webnpm --workspace studiograph-web run builddevtsc --watchdev:webnpm --workspace studiograph-web run devlintnode --max-old-space-size=8192 node_modules/typescript/bin/tsc --noEmitprepublishOnlynpm run build:allrelease:nextnpm publish --tag nexttestvitesttest:integrationvitest run --project integrationtest:unitvitest run --project unit
Dependencies46
@ai-sdk/anthropic^3.0.46@ai-sdk/google^3.0.30@ai-sdk/openai^3.0.30@aws-sdk/client-s3^3.500.0@aws-sdk/s3-request-presigner^3.1045.0@clack/prompts^0.7.0@fastify/cookie^11.0.2@fastify/cors^10.1.0@fastify/multipart^9.4.0@fastify/rate-limit^10.3.0@fastify/websocket^11.2.0@lancedb/lancedb^0.27.2@mariozechner/pi-agent-core^0.70.2@mariozechner/pi-ai^0.70.2@mariozechner/pi-tui^0.70.2@modelcontextprotocol/sdk^1.26.0@mozilla/readability^0.6.0@noble/ciphers^1.3.0@types/archiver^7.0.0ai^6.0.97archiver^7.0.1bcryptjs^3.0.3better-sqlite3^12.6.2chalk^5.6.2cli-highlight^2.1.11commander^11.1.0consola^3.4.2csv-parse^5.6.0csv-stringify^6.6.0diff-match-patch^1.0.5- …and 16 more.
Optional dependencies1
playwright^1.58.2