PkgRadar

npm · registry.npmjs.org

@ibiz-template/runtime

Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.

Why PkgRadar flagged 0.7.41-alpha.102

SeveritySignalEvidence
highJs Decode Then Execbase64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern. · package/dist/index.system.min.js

Scanned versions

VersionVerdictScoreScanned (UTC)
0.7.41-alpha.105Low risk02026-06-12
0.7.41-alpha.104Low risk02026-06-05
0.7.41-alpha.102Review222026-05-29
0.7.41-alpha.103Review222026-05-29

Block this in CI

PkgRadar gates @ibiz-template/runtime (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @ibiz-template/[email protected]