PkgRadar

Package evidence

@drewling/[email protected]

Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
267
Versions published
4
First published
Apr 2026
Publisher
tayoonabule

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@drewling/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@drewling/[email protected]"],"fail_on":"review"}'
Publishertayoonabule
Artifact bytes148,862
Previous version0.6.1
Published2026-05-28T15:07:44.750Z
SHA-2568b13443856becc9ed04a92882b947b38702634eaaf553602ba197db692903f41

Why flagged

What the scanner saw

Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
45Score
0.7.0Version
Status history (1 event)
  1. new → available · risk review · score 45 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highJs Decode Then Execpackage/build/request-executor.jsbase64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.45

Manifest

Package metadata

Scripts12
  • buildtsc && shx chmod 755 build/index.js
  • check:specnode scripts/check-spec-drift.js
  • devtsc --watch
  • fetch:specnode -e "const u=process.env.TWENTY_API_URL,k=process.env.TWENTY_API_KEY;if(!u||!k){console.error('Set TWENTY_API_URL and TWENTY_API_KEY');process.exit(1)}fetch(u.replace(/\/$/,'')+'/open-api/core',{headers:{Authorization:'Bearer '+k}}).then(r=>r.ok?r.text():Promise.reject(r.status)).then(t=>{require('fs').writeFileSync('openapi/twenty-core.json',t);console.log('Saved openapi/twenty-core.json')})"
  • fetch:spec:metadatanode -e "const u=process.env.TWENTY_API_URL,k=process.env.TWENTY_API_KEY;if(!u||!k){console.error('Set TWENTY_API_URL and TWENTY_API_KEY');process.exit(1)}fetch(u.replace(/\/$/,'')+'/open-api/metadata',{headers:{Authorization:'Bearer '+k}}).then(r=>r.ok?r.text():Promise.reject(r.status)).then(t=>{require('fs').writeFileSync('openapi/twenty-metadata.json',t);console.log('Saved openapi/twenty-metadata.json')})"
  • fetch:specsnpm run fetch:spec && npm run fetch:spec:metadata
  • prestartnpm run build
  • regenopenapi-mcp-generator --input openapi/twenty-core.json --output . --server-name twenty-mcp --server-version 0.2.0 --transport stdio --force
  • regen:metadatanode scripts/gen-metadata-tools.js
  • startnode build/index.js
  • testvitest run
  • typechecktsc --noEmit
Dependencies6
  • @modelcontextprotocol/sdk^1.10.0
  • axios^1.9.0
  • dotenv^16.4.5
  • json-schema-to-zod^2.6.1
  • pino^10.3.1
  • zod^3.24.3