Package evidence

@acurast/[email protected]

Obfuscation: matched "\\u3000"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 392
Versions published: 34Mature · −50% score
First published: Jun 2024
Publisher: papers_ch

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@acurast/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@acurast/[email protected]"],"fail_on":"review"}'

Publisherpapers_ch

Artifact bytes74,638

Previous version0.8.1

Published2026-05-25T07:40:45.015Z

SHA-2566a8042480594eee6f80d0a35477327dcd78bbb097504bc8dda3e53b7bf353b24

Why flagged

What the scanner saw

Obfuscation: matched "\\u3000"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

19d agoLast checked

reviewRisk

9Score

0.9.0Version

Status history (1 event)

new → available19d ago · risk review · score 9 · status changed

Evidence

Static findings

6 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 6 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Obfuscation	package/dist/util/cli-spinners.js	matched "\\u3000"	3
low	Obfuscation	package/dist/util/live-code-processor.js	matched "eval("	3
low	Obfuscation	package/dist/live-code.js	matched "Buffer.from(jwk.d, 'base64"	3
low	Obfuscation	package/dist/util/ora.js	matched "\\u3000"	3
low	Obfuscation	package/dist/util/printFeeCosts.js	matched "\\u2588"	3
low	Obfuscation	package/dist/commands/watch.js	matched "\\u2588"	3

Manifest

Package metadata

Scripts6

buildnpx tsc && node -e "require('fs').copyFileSync('./src/util/live-code-processor.js', './dist/util/live-code-processor.js')"
prettiernpx prettier . --write
setupnpm run build && npm i -g .
startnpm run build && node dist/index.js
testjest
test-livenpm run build && node ./dist/index.js live

Dependencies28

@acurast/dapp^1.0.1
@acurast/devtools^1.0.1
@acurast/sdk^1.2.0
@inquirer/prompts^5.0.5
@polkadot/api^16.1.2
@polkadot/api-augment^16.1.2
@polkadot/keyring^14.0.0
@polkadot/types^16.1.2
@polkadot/types-codec^16.1.2
@polkadot/util^14.0.0
@polkadot/util-crypto^14.0.0
@polkadot/wasm-crypto^7.3.2
adm-zip^0.5.16
ansis^4.1.0
bignumber.js^9.3.0
bip39^3.1.0
cli-progress^3.12.0
commander^12.1.0
dotenv^16.5.0
figlet^1.8.1
inquirer^9.2.23
is-interactive^2.0.0
listr2^8.3.3
log-symbols^6.0.0
needle^3.3.1
open^8.4.2
parse-duration^1.1.0
stdin-discarder^0.2.2