Package evidence

[email protected]

Credential file access: matched ".aws"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 388Mature · −50% score
First published: Feb 2022
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes1,304,499

Previous version15.7.0

Published2026-05-27T17:03:40.426Z

SHA-25697ab7b86be4af25a730f2d04de3e0e9b12394a09e1133c43d3167fa273c5664c

Why flagged

What the scanner saw

Credential file access: matched ".aws"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

20d agoLast checked

reviewRisk

2Score

15.8.0Version

Status history (1 event)

new → available20d ago · risk review · score 2 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Credential file access	package/dist/containers/Tenant/Info/ExternalDataSource/ExternalDataSource.js	matched ".aws"	5
low	Credential file access	package/dist/containers/Tenant/Info/i18n/en.json	matched ".aws"	3

Manifest

Package metadata

Scripts25

analyzesource-map-explorer 'build/static/js/*.js'
buildrm -rf build && DISABLE_ESLINT_PLUGIN=true CI=true rsbuild build
build:embeddedGENERATE_SOURCEMAP=false REACT_APP_BACKEND=http://localhost:8765 REACT_APP_META_BACKEND=undefined npm run build
build:embedded-mcGENERATE_SOURCEMAP=false REACT_APP_BACKEND= REACT_APP_META_BACKEND= npm run build
build:embedded:archivenpm run build:embedded && mv build embedded-ui && cp CHANGELOG.md embedded-ui/CHANGELOG.md && zip -r embedded-ui.zip embedded-ui && rm -rf embedded-ui
devDISABLE_ESLINT_PLUGIN=true TSC_COMPILE_ON_ERROR=true REACT_APP_BACKEND=http://localhost:8765 REACT_APP_META_BACKEND=undefined npm start
lintrun-p lint:*
lint:jseslint .
lint:othernpm run prettier -- --check
lint:stylesstylelint 'src/**/*.{css,scss}'
packagerm -rf dist && tsc -p tsconfig.package.json && copyfiles -u 1 'src/**/*.{css,scss,svg}' dist
preparehusky
prepublishOnlynpm run package
prettierprettier '**/*.{json,yaml,yml,md}'
startrsbuild dev
testjest
test:e2enpx playwright test --config=playwright.config.ts
test:e2e:dockerbash scripts/playwright-docker.sh
test:e2e:docker:reportPLAYWRIGHT_SHOW_REPORT=1 bash scripts/playwright-docker.sh
test:e2e:docker:update-snapshotsbash scripts/playwright-docker.sh --update-snapshots
test:e2e:installnpx playwright install --with-deps
test:e2e:localPLAYWRIGHT_BASE_URL=http://localhost:3000/ npm run test:e2e
test:e2e:update-snapshotsnpx playwright test --config=playwright.config.ts --update-snapshots
typechecktsc --noEmit
unusednpx knip --include dependencies,files,exports,types

Dependencies52

@bem-react/classname^1.6.0
@ebay/nice-modal-react^1.2.13
@gravity-ui/axios-wrapper^1.5.1
@gravity-ui/chartkit^7.1.0
@gravity-ui/components^4.18.0
@gravity-ui/date-components^3.2.3
@gravity-ui/date-utils^2.5.6
@gravity-ui/i18n^1.7.0
@gravity-ui/icons^2.17.0
@gravity-ui/illustrations^2.1.0
@gravity-ui/navigation^3.11.0
@gravity-ui/paranoid^3.0.0
@gravity-ui/react-data-table^2.2.1
@gravity-ui/react-unipika^0.5.2
@gravity-ui/table^1.10.1
@gravity-ui/uikit^7.31.1
@gravity-ui/unipika^5.2.1
@gravity-ui/websql-autocomplete^13.15.0
@hookform/resolvers^3.10.0
@mjackson/multipart-parser^0.8.2
@reduxjs/toolkit^2.8.2
@tanstack/react-table^8.20.6
@ydb-platform/monaco-ghost^0.6.1
axios^1.14.0
axios-retry^4.5.0
colord^2.9.3
copy-to-clipboard^3.3.3
crc-32^1.2.2
history^4.10.1
hotkeys-js^3.13.9
…and 22 more.