Package evidence

@dmsdc-ai/[email protected]

Obfuscation Density: high encoded/escaped-token density

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@dmsdc-ai/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@dmsdc-ai/[email protected]"],"fail_on":"review"}'

Publisherduckyoung_kim

Artifact bytes132,629

Previous version0.4.2

Published2026-05-25T05:28:28.386Z

SHA-256ca7440f196b024b54d71365dfa7d7b56e5126a85e93893aedc9c400a17ac804b

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

19d agoLast checked

reviewRisk

45Score

0.4.3Version

Status history (1 event)

new → available19d ago · risk review · score 45 · status changed

Evidence

Static findings

9 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Obfuscation Density	package/cli.js	high encoded/escaped-token density	12
medium	Remote Payload	package/install.sh	matched "curl "	12

Show all 9 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Obfuscation Density	package/cli.js	high encoded/escaped-token density	12
medium	Remote Payload	package/install.sh	matched "curl "	12
low	Obfuscation	package/cli.js	matched "\\x1b"	3
low	Obfuscation	package/daemon.js	matched "Buffer.from(payloadB64, 'base64"	3
low	Obfuscation	package/interactive-terminal.js	matched "\\x1b"	3
low	Obfuscation	package/src/prompt-symbol-registry.js	matched "\\x1b"	3
low	Obfuscation	package/src/report-enforcement.js	matched "\\x1b"	3
low	Obfuscation	package/session-state.js	matched "\\x1b"	3
low	Obfuscation	package/tui.js	matched "\\x03"	3

Manifest

Package metadata

Scripts4

regen-fixturesnode scripts/regen-snippet-fixtures.js
testnode --test test/auth.test.js test/daemon.test.js test/daemon-singleton.test.js test/cli.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/submit-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js && git diff --exit-code tests/snippet-protocol/v1/
test:cinode --test --test-reporter=spec test/auth.test.js test/daemon.test.js test/daemon-singleton.test.js test/cli.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/submit-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js && git diff --exit-code tests/snippet-protocol/v1/
test:watchnode --test --watch test/auth.test.js test/daemon.test.js test/daemon-singleton.test.js test/cli.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/submit-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js

Dependencies10

@modelcontextprotocol/sdk^1.26.0
blessed^0.1.81
cors^2.8.6
express^5.2.1
node-pty^1.2.0-beta.11
prompts^2.4.2
update-notifier^5.1.0
uuid^9.0.0
ws^8.19.0
zod^3.24.0