PkgRadar

Package evidence

[email protected]

Credential file access: matched ".ssh"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherturtle.tech
Artifact bytes9,447,471
Previous version0.3.26
Published2026-05-25T00:57:17.853Z
SHA-25678dfc32c2faed70f83bb8e5c4d264a4093dae102f8261ddd7483a4f7bc127046

Why flagged

What the scanner saw

Credential file access: matched ".ssh"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
275Score
0.3.27Version
Status history (1 event)
  1. newavailable · risk high · score 275 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

turtle.tech

7 members · evidence strength 84

Evidence

Static findings

60 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highCredential file accesspackage/assets/assets/ssh-config-_ykCGR6B.jsmatched ".ssh"30
mediumObfuscation Densitypackage/assets/assets/blade-DVc8C-J4.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/assets/assets/chunk-WL4C6EOR-C5oC_TBi.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/assets/assets/flowDiagram-PKNHOUZH-DKoU7L24.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/assets/assets/freemarker2-DLqz4_VA.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/assets/assets/julia-C8NyazO9.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/assets/assets/php-CDn_0X-4.jshigh encoded/escaped-token density12
mediumLarge Javascript Payloadpackage/assets/assets/index-Cl9Gy4vs.js6635659 bytes10
mediumLarge Javascript Payloadpackage/assets/assets/ts.worker-DUVIPRKP.js6014929 bytes10
Show all 60 findings (low-signal and informational)
SeverityKindPathDetailPoints
highCredential file accesspackage/assets/assets/ssh-config-_ykCGR6B.jsmatched ".ssh"30
mediumObfuscation Densitypackage/assets/assets/blade-DVc8C-J4.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/assets/assets/chunk-WL4C6EOR-C5oC_TBi.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/assets/assets/flowDiagram-PKNHOUZH-DKoU7L24.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/assets/assets/freemarker2-DLqz4_VA.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/assets/assets/julia-C8NyazO9.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/assets/assets/php-CDn_0X-4.jshigh encoded/escaped-token density12
mediumLarge Javascript Payloadpackage/assets/assets/index-Cl9Gy4vs.js6635659 bytes10
mediumLarge Javascript Payloadpackage/assets/assets/ts.worker-DUVIPRKP.js6014929 bytes10
lowObfuscationpackage/assets/assets/ara-BRHolxvo.jsmatched "\\x7F"3
lowObfuscationpackage/assets/assets/blade-DVc8C-J4.jsmatched "\\x7F"3
lowObfuscationpackage/assets/assets/blockDiagram-WCTKOSBZ-Ds4_MC0T.jsmatched "\\u000D"3
lowObfuscationpackage/assets/assets/c4Diagram-IC4MRINW-C1os6NTb.jsmatched "eVal("3
lowObfuscationpackage/assets/assets/chunk-WL4C6EOR-C5oC_TBi.jsmatched "\\u00AA"3
lowObfuscationpackage/assets/assets/coffee-Ch7k5sss.jsmatched "fromCharCode"3
lowObfuscationpackage/assets/assets/crystal-tKQVLTB8.jsmatched "\\x08"3
lowObfuscationpackage/assets/assets/css-DPfMkruS.jsmatched "\\uFEFF"3
lowObfuscationpackage/assets/assets/css.worker-CWXDKZjk.jsmatched "\\x20"3
lowObfuscationpackage/assets/assets/cytoscape.esm-DtBltrT8.jsmatched "\\u200b"3
lowObfuscationpackage/assets/assets/dialog-select-directory-BmhGo7hs.jsmatched "\\u0000"3
lowObfuscationpackage/assets/draco/gltf/draco_decoder.jsmatched "fromCharCode"3
lowObfuscationpackage/assets/draco/gltf/draco_wasm_wrapper.jsmatched "fromCharCode"3
lowObfuscationpackage/assets/assets/editor.worker-DERb3WoQ.jsmatched "\\x20"3
lowObfuscationpackage/assets/assets/erDiagram-INFDFZHY-DmuZ1S1z.jsmatched "\\u00C0"3
lowObfuscationpackage/assets/assets/flowDiagram-PKNHOUZH-DKoU7L24.jsmatched "\\u00AA"3
lowObfuscationpackage/assets/assets/freemarker2-DLqz4_VA.jsmatched "\\u00AA"3
lowObfuscationpackage/assets/assets/ghostty-web-DFI9ftn5.jsmatched "\\x1B"3
lowObfuscationpackage/assets/assets/glimmer-js-Rg0-pVw9.jsmatched "\\x08"3
lowObfuscationpackage/assets/assets/glimmer-ts-U6CK756n.jsmatched "\\x08"3
lowObfuscationpackage/assets/assets/hack-CaT9iCJl.jsmatched "\\x7F"3
lowObfuscationpackage/assets/assets/html-GMplVEZG.jsmatched "\\x00"3
lowObfuscationpackage/assets/assets/html.worker-C8-N0mNh.jsmatched "\\x20"3
lowObfuscationpackage/assets/assets/journeyDiagram-4ABVD52K-Dvm95U5p.jsmatched "eVal("3
lowObfuscationpackage/assets/assets/json.worker-B4wBgYVH.jsmatched "\\x20"3
lowObfuscationpackage/assets/assets/jsonMode-DNVxNWJA.jsmatched "fromCharCode"3
lowObfuscationpackage/assets/assets/julia-C8NyazO9.jsmatched "\\x01"3
lowObfuscationpackage/assets/assets/less-B1dDrJ26.jsmatched "\\x00"3
lowObfuscationpackage/assets/assets/list-CbLd2QpP.jsmatched "\\u0300"3
lowObfuscationpackage/assets/assets/mermaid.core-DekouHcR.jsmatched "\\x1B"3
lowObfuscationpackage/assets/assets/move-Bu9oaDYs.jsmatched "\\x00"3
lowObfuscationpackage/assets/assets/php-CDn_0X-4.jsmatched "\\x7F"3
lowObfuscationpackage/assets/assets/puppet-BMWR74SV.jsmatched "\\x7F"3
lowObfuscationpackage/assets/assets/ruby-BvKwtOVI.jsmatched "\\x00"3
lowObfuscationpackage/assets/assets/sankeyDiagram-WA2Y5GQK-7a0tOx42.jsmatched "\\u000D"3
lowObfuscationpackage/assets/assets/scss-OYdSNvt2.jsmatched "\\x00"3
lowObfuscationpackage/assets/assets/sequenceDiagram-2WXFIKYE-CfqOEUPe.jsmatched "eVal("3
lowObfuscationpackage/assets/assets/session-C1WGvWnQ.jsmatched "\\x1B"3
lowObfuscationpackage/assets/assets/sparql-DHaeiCBh.jsmatched "\\u00a0"3
lowObfuscationpackage/assets/assets/stata-BH5u7GGu.jsmatched "\\x00"3
lowObfuscationpackage/assets/assets/stylus-BEDo0Tqx.jsmatched "\\x00"3
lowObfuscationpackage/assets/assets/swift-DwJ7jVG9.jsmatched "\\u00A1"3
lowObfuscationpackage/assets/assets/treemap-KZPCXAKY-CkeXn87D.jsmatched "\\u2028"3
lowObfuscationpackage/assets/assets/twig-CO9l9SDP.jsmatched "\\x7F"3
lowObfuscationpackage/assets/assets/typst-DHCkPAjA.jsmatched "\\x00"3
lowObfuscationpackage/assets/assets/vb-DgyLZaXg.jsmatched "\\u201c"3
lowObfuscationpackage/assets/assets/vue-DnHKYNfI.jsmatched "\\x00"3
lowObfuscationpackage/assets/assets/wasm-CG6Dc4jp.jsmatched "atob("3
lowObfuscationpackage/assets/assets/worker-BDowWIry.jsmatched "\\uD800"3
lowObfuscationpackage/assets/assets/xlsx-editor-slR-Oj8_.jsmatched "fromCharCode"3
lowObfuscationpackage/bin/cli.mjsmatched "Buffer.from(normalized, \"base64"3

Manifest

Package metadata

Scripts2
  • buildbun script/build.ts
  • testbun test
Optional dependencies12
  • turtlecode-backend-darwin-arm640.3.27
  • turtlecode-backend-darwin-x640.3.27
  • turtlecode-backend-darwin-x64-baseline0.3.27
  • turtlecode-backend-linux-arm640.3.27
  • turtlecode-backend-linux-arm64-musl0.3.27
  • turtlecode-backend-linux-x640.3.27
  • turtlecode-backend-linux-x64-baseline0.3.27
  • turtlecode-backend-linux-x64-baseline-musl0.3.27
  • turtlecode-backend-linux-x64-musl0.3.27
  • turtlecode-backend-windows-arm640.3.27
  • turtlecode-backend-windows-x640.3.27
  • turtlecode-backend-windows-x64-baseline0.3.27