PkgRadar

Package evidence

[email protected]

Credential file access: matched ".azure"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherabudhahir
Artifact bytes29,883,812
Previous versionnone
Published2026-05-22T11:41:21.574Z
SHA-2565a68f7bb256988d2a63505306ea19ccc0ffcfd17671edb81d59ac95e876ba388

Why flagged

What the scanner saw

Credential file access: matched ".azure"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
2224Score
0.5.2Version
Status history (1 event)
  1. newavailable · risk high · score 2224 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

abudhahir

4 members · evidence strength 84

Evidence

Static findings

531 static · 0 from release diff · showing high-signal first.

Showing 30 of 69 findings.

SeverityKindPathDetailPoints
highCredential file accesspackage/dist/client/assets/css-zrdFFahf.jsmatched ".azure"30
highCredential file accesspackage/dist/client/assets/shell-DhAwSAum.jsmatched ".ssh"30
highCredential file accesspackage/dist/client/assets/stylus-CQ8h_EBd.jsmatched ".azure"30
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-B1il60CL.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-Ba__vyg2.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-Bbi1P058.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-BD3lbBbo.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-BEg4AcmG.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-BgtyUp7B.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-BiMb0CDF.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-BTy1x_OI.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-C196HfEM.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-CnVrHQJt.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-CtNGzBTk.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-D4aV7nCM.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-D7d19V2o.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-DbVZmceM.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-Dc8X1Abo.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-DeZwPLKy.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-DjH67I4X.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-DNJtN4Hq.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-DzijmY0P.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-hWpzaaZx.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-mM7wUgbC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-wyT5SpUV.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-5IyAbKBR.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-6U4Wx-0H.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-B14pDYt_.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-B5VTrXAw.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-B8Z9yePu.jshigh encoded/escaped-token density12
Show all 531 findings (low-signal and informational)

Showing 60 of 531 findings.

SeverityKindPathDetailPoints
highCredential file accesspackage/dist/client/assets/css-zrdFFahf.jsmatched ".azure"30
highCredential file accesspackage/dist/client/assets/shell-DhAwSAum.jsmatched ".ssh"30
highCredential file accesspackage/dist/client/assets/stylus-CQ8h_EBd.jsmatched ".azure"30
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-B1il60CL.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-Ba__vyg2.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-Bbi1P058.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-BD3lbBbo.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-BEg4AcmG.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-BgtyUp7B.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-BiMb0CDF.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-BTy1x_OI.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-C196HfEM.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-CnVrHQJt.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-CtNGzBTk.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-D4aV7nCM.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-D7d19V2o.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-DbVZmceM.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-Dc8X1Abo.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-DeZwPLKy.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-DjH67I4X.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-DNJtN4Hq.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-DzijmY0P.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-hWpzaaZx.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-mM7wUgbC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/chunk-727SXJPM-wyT5SpUV.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-5IyAbKBR.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-6U4Wx-0H.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-B14pDYt_.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-B5VTrXAw.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-B8Z9yePu.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-BoYaZnIo.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-BqNK_80V.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-BSz792Sh.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-Bxm5Jm5b.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-C2teHy8_.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-C97kQ43g.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-CdVNJhHu.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-CEdWHQSl.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-ChSST79N.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-DfkrPvM2.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-DLHyGjaB.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-DM1fvwic.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-Dnrrq-TH.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-DnRzvkMV.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-dtQ_6e4o.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-hOvXT-u3.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/client/assets/flowDiagram-I6XJVG4X-MoPJDDIv.jshigh encoded/escaped-token density12
mediumLarge Javascript Payloadpackage/dist/client/assets/index-8Cq9X1Dm.js2522725 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-BaRJFBNW.js2514867 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-BHNwKFFg.js2524666 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-Br2yAD03.js2528663 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-BSekBmD2.js2522627 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-CDxiP050.js2512661 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-CH-Q9Bwo.js2524567 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-CoOd8uCJ.js2514967 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-CsVh68Fy.js2515018 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-D-5iidPU.js2528663 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-D15ajf37.js2512643 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-D4clfjdr.js2318443 bytes10
mediumLarge Javascript Payloadpackage/dist/client/assets/index-D54t6xwu.js2514974 bytes10

Manifest

Package metadata

Scripts11
  • buildnode scripts/build-server.mjs && vite build
  • devconcurrently "vite --host 127.0.0.1" "tsx src/cli/index.ts --dev-client http://127.0.0.1:5173"
  • e2e:servernpm run build && node dist/cli/index.js tests/fixtures/docs-root --no-open --port 4173
  • linttsc -p tsconfig.node.json --noEmit && vite build --mode test
  • pack:checknode scripts/check-packlist.mjs
  • prepublishOnlynpm run build && npm run lint && npm test && npm run test:e2e && npm run pack:check
  • testvitest run --passWithNoTests
  • test:clientvitest run tests/client
  • test:e2eplaywright test
  • test:servervitest run tests/server tests/shared
  • test:watchvitest
Dependencies11
  • @mantine/core^9.2.1
  • @mantine/hooks^9.2.1
  • @mdxeditor/editor^3.43.0
  • @vitejs/plugin-react^6.0.2
  • express^5.2.1
  • lucide-react^0.561.0
  • mermaid^11.12.2
  • react^19.2.3
  • react-dom^19.2.3
  • react-markdown^10.1.0
  • remark-gfm^4.0.1