PyPI · pypi.org

mercury

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Why PkgRadar flagged 3.2.1

Severity	Signal	Evidence
high	Js Split Join Obfuscation	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis. · mercury_app/static/chunk.3f28a70b86862b4b010e.js
high	Js Split Join Obfuscation	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis. · mercury_app/static/chunk.40f34bf6e21ddece3431.js
high	Js Split Join Obfuscation	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis. · mercury_app/static/chunk.7b56766a01a25b233ce5.js
high	Js Split Join Obfuscation	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis. · mercury_app/static/chunk.c1ecc1a481ae0f285db1.js
high	Js Split Join Obfuscation	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis. · mercury_app/static/chunk.ed9d99ea72f766ea879d.js
high	Js Split Join Obfuscation	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis. · mercury_app/static/chunk.f2474f06a59cf728421f.js

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`3.2.1`	High risk	25	2026-06-09
`3.2.0`	High risk	25	2026-05-30
`3.1.5`	High risk	25	2026-05-30
`3.1.4`	High risk	25	2026-05-30

Block this in CI

PkgRadar gates mercury (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi mercury==3.2.1

Start free — 25 scans / mo View full evidence