PkgRadar

Package evidence

@1agh/[email protected]

Js Split Join Obfuscation, Tls Verification Disabled, Remote Payload +1 more

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,219Niche · −30% score
Versions published
44
First published
May 2026
Publisher
1agh

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Add to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@1agh/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@1agh/[email protected]"],"fail_on":"high"}'
Publisher1agh
Artifact bytes21,619,538
Previous version0.45.2
Published2026-07-18T07:41:45.949Z
SHA-256439cb830f6dd8113016e55ec5575c5ea1d6fa95b5649475d6c3ec9cc395a92f6

Why flagged

What the scanner saw

Js Split Join Obfuscation

1 candidate cluster(s) currently reference this release.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
65Score
0.46.0Version
Status history (1 event)
  1. new → available · risk high · score 65 · status changed

Related candidates

Linked campaigns and clusters

Repeated static TTPactive

Js Split Join Obfuscation

1276 members · evidence strength 90
Repeated static TTPcandidate

Js Split Join Obfuscation

1276 members · max score 311

Evidence

Static findings

16 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highJs Split Join Obfuscationmanifest—40
mediumTls Verification Disabledmanifest—12
mediumTls Verification Disabledmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
Show all 16 findings (low-signal and informational)
SeverityKindPathDetailPoints
highJs Split Join Obfuscationmanifest—40
mediumTls Verification Disabledmanifest—12
mediumTls Verification Disabledmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
mediumRemote Payloadmanifest—12
lowInstall-time lifecycle scriptmanifest—5

Manifest

Package metadata

Dependencies4
  • ajv^8.20.0
  • ajv-formats^3.0.1
  • happy-dom20.10.6
  • svgo^4.0.1
Optional dependencies7
  • @1agh/maude-darwin-arm640.46.0
  • @1agh/maude-darwin-x640.46.0
  • @1agh/maude-linux-arm640.46.0
  • @1agh/maude-linux-arm64-musl0.46.0
  • @1agh/maude-linux-x640.46.0
  • @1agh/maude-linux-x64-musl0.46.0
  • @1agh/maude-win32-x640.46.0