Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Known Indicator Filename: package/dist/src/search/bundle.js
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 144 · status changed
Related candidates
Linked campaigns and clusters
Known Indicator Filename — package/dist/src/search/bundle.js
3 members · evidence strength 80marazmo
3 members · evidence strength 74Evidence
Static findings
10 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/dist/src/search/bundle.js | package/dist/src/search/bundle.js | 45 |
| high | Credential file access | package/dist/src/server/tools/ast-grep.js | matched ".aws" | 30 |
| high | Credential file access | package/dist/src/workspace.js | matched ".ssh" | 30 |
| medium | Remote Payload | package/dist/src/memory/export.js | matched "curl " | 12 |
| medium | Remote Payload | package/dist/src/utils/ollama.js | matched "curl " | 12 |
Show all 10 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/dist/src/search/bundle.js | package/dist/src/search/bundle.js | 45 |
| high | Credential file access | package/dist/src/server/tools/ast-grep.js | matched ".aws" | 30 |
| high | Credential file access | package/dist/src/workspace.js | matched ".ssh" | 30 |
| medium | Remote Payload | package/dist/src/memory/export.js | matched "curl " | 12 |
| medium | Remote Payload | package/dist/src/utils/ollama.js | matched "curl " | 12 |
| low | Obfuscation | package/dist/src/server/audit-analysis.js | matched "eval(" | 3 |
| low | Obfuscation | package/dist/src/utils/audit-history.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/dist/src/doctor.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/src/indexer/embedder.js | matched "\\u0300" | 3 |
| low | Obfuscation | package/dist/src/indexer/indexer.js | matched "\\x00" | 3 |
Manifest
Package metadata
Scripts17
benchnode scripts/bench-reproducer.mjsbench:latencynode scripts/mcp-latency-profile.mjsbench:patternsnode --experimental-strip-types --no-warnings benchmark/src/patterns/index.tsbench:playgroundnode scripts/generate-playground-data.mjsbench:quicknode --experimental-strip-types --no-warnings benchmark/src/index.tsbench:researchnode --experimental-strip-types --no-warnings benchmark/src/research/index.tsbench:swenode --experimental-strip-types --no-warnings benchmark/src/swe/index.tsbenchmarknode --experimental-strip-types benchmark/benchmark.tsbuildtsc && node scripts/post-build.mjsdevtsc --watchlinteslint src/lint:assetsnode scripts/lint-assets.mjsprepublishOnlynode scripts/verify-plugin-sync.mjs && rm -rf dist && npm run buildstartnode dist/bin/sverklo.jstestvitest runtest:watchvitestverify:plugin-syncnode scripts/verify-plugin-sync.mjs
Dependencies6
@modelcontextprotocol/sdk^1.12.0chokidar^4.0.0ignore^7.0.0onnxruntime-node^1.21.0picomatch^4.0.4yaml^2.8.3
Optional dependencies1
web-tree-sitter^0.24.0