PkgRadar

npm · registry.npmjs.org

ghost

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Why PkgRadar flagged 6.43.1

SeveritySignalEvidence
highJs Split Join ObfuscationArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis. · package/core/built/admin/assets/chunk.381.0672ceb836fd46c72c4d.js

Scanned versions

VersionVerdictScoreScanned (UTC)
6.44.0Low risk02026-06-03
6.43.1Review122026-05-29
6.43.0Review122026-05-29
6.42.0Review602026-05-27
6.41.0Review602026-05-25
6.41.1Review602026-05-25

Block this in CI

PkgRadar gates ghost (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence