Package evidence

@devvit/[email protected]

Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 4,757Niche · −30% score
Versions published: 3,726Mature · −50% score
First published: Feb 2023
Publisher: colacadstink

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@devvit/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@devvit/[email protected]"],"fail_on":"review"}'

Publishercolacadstink

Artifact bytes1,603,203

Previous version0.13.1-next-2026-05-27-22-50-14-2f8c5db01.0

Published2026-05-28T21:15:55.462Z

SHA-256f9e03c04ce91bbf9981638528fd1f076967604eb8326a29bc76641117b0b001a

Why flagged

What the scanner saw

Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

19d agoLast checked

reviewRisk

25Score

0.13.1-next-2026-05-28-21-15-15-d4656db34.0Version

Status history (1 event)

new → available19d ago · risk review · score 25 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Js Decode Then Exec	package/devvit-custom-post.min.js	base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.	45
high	Js Decode Then Exec	package/devvit-surface.min.js	base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.	45

Manifest

Package metadata

Scripts31

buildyarn library:build
build:minesbuild --bundle --external:@reddit/baseplate --format=esm --minify --sourcemap=linked --target=es2020
cleanrm -rf .turbo coverage dist library/src/semanticColors.ts
clobberyarn clean && rm -rf node_modules
dev:buildchokidar ./library/src ../shared-types/dist --command 'yarn build && echo "BUILD COMPLETE"' --ignore './library/src/semanticColors.ts'
library:buildyarn library:build:semantic-colors && yarn library:build:typescript && yarn library:build:styles
library:build:custom-stylescd library && postcss custom-styles.css -o ../dist/custom-styles.css
library:build:semantic-colorsscripts/make-semantic-colors.js
library:build:stylescd library && postcss styles.css -o tailwind-build.css && yarn library:build:styles-dist && yarn library:build:custom-styles
library:build:styles-distscripts/make-styles.js
library:build:typescripttsc --project tsconfig.json
library:devconcurrently -n 'lib:styles,lib:styles-dist,lib:typescript' 'yarn library:dev:styles' 'yarn library:dev:styles-dist' 'yarn library:dev:typescript'
library:dev:stylesyarn library:build:styles -w
library:dev:styles-distyarn library:build:styles-dist --watch
library:dev:typescriptyarn library:build:typescript -w
library:lintredlint ./library
library:lint:fixyarn library:lint --fix
library:testyarn library:test:unit && yarn library:test:types && yarn library:lint
library:test:typestsc --noEmit -p library
library:test:unitvitest run -r library -c vitest.config.js
library:test:unit-with-coverageyarn library:test:unit --coverage
lintyarn library:lint && yarn lint:circular-deps
lint:circular-depsyarn madge --circular dist/**/*.js
lint:fixyarn library:lint:fix
prepublishOnlypublish-package-json
shreddit:devnode scripts/shreddit-development-bridge.js
testyarn library:test && yarn test:size
test:sizeyarn build:min --metafile=dist/devvit-custom-post-meta.min.json --outfile=dist/devvit-custom-post.min.js library/src/client/devvit-custom-post.ts && yarn build:min --metafile=dist/devvit-surface-meta.min.json --outfile=dist/devvit-surface.min.js library/src/client/devvit-surface.ts && filesize
test:typesyarn library:test:types
test:unityarn library:test:unit
…and 1 more.

Dependencies7

@devvit/multiplatform0.0.1-20250218-2f1c7a2a
@devvit/protos0.13.1-next-2026-05-28-21-15-15-d4656db34.0
@devvit/runtime-lite0.13.1-next-2026-05-28-21-15-15-d4656db34.0
@devvit/shared-types0.13.1-next-2026-05-28-21-15-15-d4656db34.0
compare-versions6.1.1
nice-grpc-web3.3.3
p-queue7.3.4

Optional dependencies1

lit^2.0.0