PkgRadar

PyPI · pypi.org

fastclaw-ai

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Why PkgRadar flagged 1.1.10

SeveritySignalEvidence
highJs Split Join ObfuscationArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis. · fastclaw_ai-1.1.10/fastclaw/webui/static/js/element-plus.full.min.js

Scanned versions

VersionVerdictScoreScanned (UTC)
1.1.15Low risk02026-06-12
1.1.14Low risk02026-06-12
1.1.13Low risk02026-06-11
1.1.12Low risk02026-06-10
1.1.11Low risk02026-06-03
1.1.10High risk402026-05-31
1.1.9High risk402026-05-31

Block this in CI

PkgRadar gates fastclaw-ai (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi fastclaw-ai==1.1.10
Start free — 25 scans / moView full evidence