Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 183
- Versions published
- 9
- First published
- Mar 2026
- Publisher
- wladimiiir
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@aiderdesk/[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@aiderdesk/[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Obfuscation Density: high encoded/escaped-token density
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (3 events)
- available → available · risk high · score 142 · status available -> available, risk high -> high, score 167 -> 142
- available → available · risk high · score 167 · status available -> available, risk high -> high, score 299 -> 167
- new → available · risk high · score 299 · status changed
Related candidates
Linked campaigns and clusters
wladimiiir
2 members · evidence strength 64Install-time lifecycle script — postinstall="patch-package && resources_dir=./out/resources node scripts/download-probe.mjs --current-platform-only"
2 members · evidence strength 70Evidence
Static findings
42 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/out/resources/mcp-server/backup/aider-desk-mcp-server-bundled.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/out/renderer/assets/index-3bI-dJm8.js | 48131988 bytes | 10 |
| medium | Invalid Package Json | package/out/resources/skills/extension-creator/assets/templates/folder-extension/package.json | package.json is not valid JSON | 10 |
Show all 42 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/out/resources/mcp-server/backup/aider-desk-mcp-server-bundled.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/out/renderer/assets/index-3bI-dJm8.js | 48131988 bytes | 10 |
| medium | Invalid Package Json | package/out/resources/skills/extension-creator/assets/templates/folder-extension/package.json | package.json is not valid JSON | 10 |
| low | Credential file access | package/out/renderer/assets/ssh-config-Bk_I5wDR.js | matched ".ssh" | 5 |
| low | Install-time lifecycle script | package.json | postinstall="patch-package && RESOURCES_DIR=./out/resources node scripts/download-probe.mjs --current-platform-only" | 5 |
| low | Obfuscation | package/out/resources/mcp-server/backup/aider-desk-mcp-server-bundled.js | matched "\\x0D" | 3 |
| low | Obfuscation | package/out/resources/mcp-server/aider-desk-mcp-server.js | matched "\\u2028" | 3 |
| low | Obfuscation | package/out/renderer/assets/ara-DRBH84ND.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/out/renderer/assets/blade-BbH7YAUi.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/out/renderer/assets/blockDiagram-GPEHLZMM-DQ2DevZl.js | matched "\\u000D" | 3 |
| low | Obfuscation | package/out/renderer/assets/c4Diagram-AAUBKEIU-BdR46VbA.js | matched "eVal(" | 3 |
| low | Obfuscation | package/out/renderer/assets/chunk-727SXJPM-vXEiesCP.js | matched "\\u00AA" | 3 |
| low | Obfuscation | package/out/cli.js | matched "\\x1B" | 3 |
| low | Obfuscation | package/out/renderer/assets/coffee-XLjtuEYs.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/out/renderer/assets/crystal-BqBRy7Ec.js | matched "\\x08" | 3 |
| low | Obfuscation | package/out/renderer/assets/css-BtVcDqlU.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/out/renderer/assets/cytoscape.esm-Bm8DJGmZ.js | matched "\\u200b" | 3 |
| low | Obfuscation | package/out/renderer/assets/erDiagram-TEJ5UH35-DolRLBng.js | matched "\\u00C0" | 3 |
| low | Obfuscation | package/out/renderer/assets/flowDiagram-I6XJVG4X-DjAbl_XC.js | matched "\\u00AA" | 3 |
| low | Obfuscation | package/out/renderer/assets/glimmer-js-h2QNNiD7.js | matched "\\x08" | 3 |
| low | Obfuscation | package/out/renderer/assets/glimmer-ts-Bk3uX6Ae.js | matched "\\x08" | 3 |
| low | Obfuscation | package/out/renderer/assets/hack-BTX3ICIE.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/out/renderer/assets/html-GC16tDh9.js | matched "\\x00" | 3 |
| low | Obfuscation | package/out/renderer/assets/journeyDiagram-JHISSGLW-Dmitv8wD.js | matched "eVal(" | 3 |
| low | Obfuscation | package/out/renderer/assets/julia-CU_UwNb8.js | matched "\\x01" | 3 |
| low | Obfuscation | package/out/renderer/assets/katex-DK1nL-FM.js | matched "\\x00" | 3 |
| low | Obfuscation | package/out/renderer/assets/less-BAzLMJNR.js | matched "\\x00" | 3 |
| low | Obfuscation | package/out/renderer/assets/php-C2HieitX.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/out/renderer/assets/puppet-N15G4Usj.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/out/renderer/assets/quadrantDiagram-W4KKPZXB-DeX0zTCp.js | matched "\\x00" | 3 |
| low | Obfuscation | package/out/renderer/assets/ruby-C13Bjepi.js | matched "\\x00" | 3 |
| low | Obfuscation | package/out/renderer/assets/sankeyDiagram-5OEKKPKP-BuCv8QIY.js | matched "\\u000D" | 3 |
| low | Obfuscation | package/out/renderer/assets/scss-Dq-LbI_c.js | matched "\\x00" | 3 |
| low | Obfuscation | package/out/renderer/assets/sequenceDiagram-3UESZ5HK-Zg7Ukud8.js | matched "eVal(" | 3 |
| low | Obfuscation | package/out/renderer/assets/stata-Dl7wDdBE.js | matched "\\x00" | 3 |
| low | Obfuscation | package/out/renderer/assets/stylus-DXFa_2Jl.js | matched "\\x00" | 3 |
| low | Obfuscation | package/out/renderer/assets/twig-CwEEYIBf.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/out/renderer/assets/typst-XYLFxYau.js | matched "\\x00" | 3 |
| low | Obfuscation | package/out/renderer/assets/vue-K-7Ga-y8.js | matched "\\x00" | 3 |
| low | Obfuscation | package/out/renderer/assets/wardley-L42UT6IY-BiqfHMim.js | matched "\\u2028" | 3 |
| low | Obfuscation | package/out/renderer/assets/wasm-DDgzZJey.js | matched "atob(" | 3 |
| low | Obfuscation | package/out/renderer/assets/worker-CfJUABHG.js | matched "\\uD800" | 3 |
Manifest
Package metadata
Scripts1
postinstallpatch-package && RESOURCES_DIR=./out/resources node scripts/download-probe.mjs --current-platform-only
Dependencies71
@ai-sdk/alibaba^0.0.6@ai-sdk/amazon-bedrock^3.0.97@ai-sdk/anthropic^2.0.77@ai-sdk/azure^2.0.105@ai-sdk/cerebras^1.0.41@ai-sdk/deepseek1.0.37@ai-sdk/google^2.0.70@ai-sdk/google-vertex^3.0.132@ai-sdk/groq^2.0.38@ai-sdk/mistral2.0.30@ai-sdk/openai^2.0.103@ai-sdk/openai-compatible^1.0.36@aiderdesk/extensions0.15.0@augmentcode/auggie-sdk0.1.15@aws-sdk/client-bedrock^3.887.0@aws-sdk/credential-providers^3.782.0@dmitryrechkin/json-schema-to-zod^1.0.1@dotenvx/dotenvx^1.24.5@google-cloud/aiplatform^5.7.0@google/genai^1.30.0@homebridge/node-pty-prebuilt-multiarch^0.13.1@huggingface/transformers^3.8.1@lancedb/lancedb^0.22.3@mariozechner/pi-tui^0.63.1@modelcontextprotocol/sdk^1.20.0@openrouter/ai-sdk-provider^1.5.4@posthog/ai^7.18.1@requesty/ai-sdk^2.3.0adm-zip^0.5.16ai5.0.179- …and 41 more.