Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@compilr-dev/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@compilr-dev/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Credential file access: matched "GITHUB_TOKEN"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 91 · status changed
Evidence
Static findings
34 static · 0 from release diff · showing high-signal first.
No high-signal findings — see all findings below.
Show all 34 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| low | Credential file access | package/dist/ui/overlay/data/tutorials/config/mcp-servers.js | matched "GITHUB_TOKEN" | 5 |
| low | Obfuscation | package/dist/ui/overlay/impl/anchors-overlay-v2.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/artifact-detail-overlay-v2.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/config-overlay-v2.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/custom-agent-form-overlay-v2.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/document-detail-overlay-v2.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/games/game-base.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/games/tetris/index.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/base/inline-overlay-utils.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/ui/input-prompt.js | matched "\\x7f" | 3 |
| low | Obfuscation | package/dist/ui/keyboard-handler.js | matched "\\x01" | 3 |
| low | Obfuscation | package/dist/ui/line-utils.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/markdown-renderer.js | matched "\\u001b" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/mascot-overlay-v2.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/mcp-overlay-v2.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/model-overlay-v2.js | matched "\\x20" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/onboarding-wizard-overlay-v2.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/base/overlay-base.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/overlay-manager.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/overlays.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/handlers/permission-handler.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/mascot/renderer.js | matched "\\x1B" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/resume-overlay-v2.js | matched "\\u26A0" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/skill-detail-overlay-v2.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/skill-editor-overlay.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/slash-autocomplete.js | matched "\\x1B" | 3 |
| low | Obfuscation | package/dist/ui/startup-menu.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/tabbed-menu.js | matched "\\x1B" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/team-overlay-v2.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/terminal-codes.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/terminal-render-item.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/terminal-ui.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/terminal.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist/ui/overlay/impl/tutorial-overlay-v2.js | matched "\\x1B" | 3 |
Manifest
Package metadata
Scripts15
buildtsc -b && chmod +x dist/index.jsbuild:vsixcd vscode-extension && npx @vscode/vsce package --out ../dist/compilr-diff-companion.vsixcleantsc -b --clean && rm -rf distdevtsc -b && node dist/index.jslinteslint src/lint:fixeslint src/ --fixprepublishOnlynpm run lint && npm test && npm run build && npm run build:vsixstartnode dist/index.jstestvitest runtest:coveragevitest run --coveragetest:repl-v2npx tsx scripts/test-repl-v2.tstest:scrollnpx tsx scripts/test-scroll-regions.tstest:scroll-inputnpx tsx scripts/test-scroll-input.tstest:uinpx tsx scripts/test-terminal-ui.tstest:watchvitest
Dependencies20
@anthropic-ai/sdk^0.74.0@compilr-dev/agents^0.5.8@compilr-dev/agents-coding^1.0.4@compilr-dev/editor-core^0.0.2@compilr-dev/factory^0.1.30@compilr-dev/logger^0.1.0@compilr-dev/sdk^0.10.9@compilr-dev/ui-core^0.0.1@modelcontextprotocol/sdk^1.23.0ansi-escapes^7.3.0better-sqlite3^12.5.0chalk^5.6.2cli-highlight^2.1.11cli-table3^0.6.5highlight.js^11.11.1js-tiktoken^1.0.21marked^18.0.3picocolors^1.1.1supports-hyperlinks^3.2.0uuid^14.0.0