PkgRadar

Package evidence

trpc-agent-py==1.1.8

Credential File Packaged: trpc_agent_py-1.1.8/examples/a2a/.env

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
10
First published
Apr 2026

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["trpc-agent-py==1.1.8"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["trpc-agent-py==1.1.8"],"fail_on":"high"}'
Publisherunknown
Artifact bytes8,378,805
Previous versionnone
Published2026-06-12T11:41:30
SHA-25622771e277e978b33895a89fb31c2768ff06c278f4763f107ca55dec65a632753

Why flagged

What the scanner saw

Credential File Packaged: trpc_agent_py-1.1.8/examples/a2a/.env

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
100Score
1.1.8Version
Status history (1 event)
  1. new → available · risk high · score 100 · status changed

Evidence

Static findings

103 static · 0 from release diff · showing high-signal first.

Showing 30 of 103 findings.

SeverityKindPathDetailPoints
highCredential File Packagedtrpc_agent_py-1.1.8/examples/a2a/.envtrpc_agent_py-1.1.8/examples/a2a/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/a2a_with_cancel/.envtrpc_agent_py-1.1.8/examples/a2a_with_cancel/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/agent_tools/.envtrpc_agent_py-1.1.8/examples/agent_tools/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/agui/.envtrpc_agent_py-1.1.8/examples/agui/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/agui_with_cancel/.envtrpc_agent_py-1.1.8/examples/agui_with_cancel/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/claude_agent/.envtrpc_agent_py-1.1.8/examples/claude_agent/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/claude_agent_with_cancel/.envtrpc_agent_py-1.1.8/examples/claude_agent_with_cancel/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/claude_agent_with_code_writer/.envtrpc_agent_py-1.1.8/examples/claude_agent_with_code_writer/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/claude_agent_with_skills/.envtrpc_agent_py-1.1.8/examples/claude_agent_with_skills/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/claude_agent_with_streaming_tool/.envtrpc_agent_py-1.1.8/examples/claude_agent_with_streaming_tool/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/claude_agent_with_travel_planner/.envtrpc_agent_py-1.1.8/examples/claude_agent_with_travel_planner/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/code_executors/.envtrpc_agent_py-1.1.8/examples/code_executors/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/dsl/classifier_mcp/.envtrpc_agent_py-1.1.8/examples/dsl/classifier_mcp/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/evaluation/callbacks/.envtrpc_agent_py-1.1.8/examples/evaluation/callbacks/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/evaluation/context_messages/.envtrpc_agent_py-1.1.8/examples/evaluation/context_messages/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/evaluation/custom_runner/.envtrpc_agent_py-1.1.8/examples/evaluation/custom_runner/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/evaluation/llm_final_response/.envtrpc_agent_py-1.1.8/examples/evaluation/llm_final_response/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/evaluation/llm_judge_tools/.envtrpc_agent_py-1.1.8/examples/evaluation/llm_judge_tools/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/evaluation/llm_rubric_knowledge_recall/.envtrpc_agent_py-1.1.8/examples/evaluation/llm_rubric_knowledge_recall/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/evaluation/llm_rubric_response/.envtrpc_agent_py-1.1.8/examples/evaluation/llm_rubric_response/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/evaluation/pass_at_k/.envtrpc_agent_py-1.1.8/examples/evaluation/pass_at_k/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/evaluation/quickstart/.envtrpc_agent_py-1.1.8/examples/evaluation/quickstart/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/evaluation/trace_mode/.envtrpc_agent_py-1.1.8/examples/evaluation/trace_mode/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/evaluation/webui/.envtrpc_agent_py-1.1.8/examples/evaluation/webui/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/fastapi_server/.envtrpc_agent_py-1.1.8/examples/fastapi_server/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/file_tools/.envtrpc_agent_py-1.1.8/examples/file_tools/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/filter_with_agent/.envtrpc_agent_py-1.1.8/examples/filter_with_agent/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/filter_with_model/.envtrpc_agent_py-1.1.8/examples/filter_with_model/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/filter_with_tool/.envtrpc_agent_py-1.1.8/examples/filter_with_tool/.env35
highCredential File Packagedtrpc_agent_py-1.1.8/examples/function_tools/.envtrpc_agent_py-1.1.8/examples/function_tools/.env35