PkgRadar

npm · registry.npmjs.org

@needle-tools/engine

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Why PkgRadar flagged 5.1.0-alpha.8

SeveritySignalEvidence
highJs Split Join ObfuscationArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis. · package/dist/three.umd.cjs
highJs Split Join ObfuscationArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis. · package/dist/three.js
highJs Split Join ObfuscationArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis. · package/dist/three.min.js

Scanned versions

VersionVerdictScoreScanned (UTC)
5.1.0-canary.1781708259.constantine-the-great.e95b0efLow risk02026-06-17
5.1.0-canary.1781705506.ramesses-the-great.1588ad8Low risk02026-06-17
5.1.0-canary.1781702410.meh-pierogi.cd54b5eLow risk02026-06-17
5.1.0-canary.1781689797.erik-the-red.aedef55Low risk02026-06-17
5.1.0-canary.1781621433.brooding-marie-antoinette.332086dLow risk02026-06-16
5.1.0-beta.2Low risk02026-06-12
5.1.0-beta.1Low risk02026-06-09
5.1.0-betaLow risk02026-06-08
5.1.0-canary.1780922887.william-the-conqueror.c7d26c0Low risk02026-06-08
5.1.0-canary.1780678487.dramatic-marco-polo.82e97daLow risk02026-06-05
5.1.0-alpha.9Low risk02026-06-05
5.1.0-next.1780579670.dramatic-pierogi.b8fa941Low risk02026-06-04
4.16.11Low risk02026-06-04
5.1.0-alpha.8Review152026-05-29
5.1.0-alpha.7Review152026-05-29
5.1.0-canary.1779986375.reasonable-macaron.35e9d4aReview162026-05-28
5.1.0-canary.sulky-napoleon-bonaparte.208767eReview262026-05-27
5.1.0-canary.1779901560.furious-charlemagne-of-franks.798a9aaReview192026-05-27
5.1.0-canary.1779818465.fine-biscotti.263706cReview192026-05-26
5.1.0-canary.sleepy-alexander-hamilton.7392af5Review192026-05-26
5.1.0-canary.reasonable-kimchi.bfe5fa0Review192026-05-25
5.1.0-canary.leif-erikson.3ea0bf7Review192026-05-25
5.1.0-canary.max-planck.33944eeReview192026-05-25
5.1.0-canary.ludwig-van-beethoven.aeeaaa2Review192026-05-25
5.1.0-canary.stoic-richard-the-third.493600aReview192026-05-25

Block this in CI

PkgRadar gates @needle-tools/engine (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @needle-tools/[email protected]
Start free — 25 scans / moView full evidence