Package evidence

@enbox/[email protected]

Remote Payload: matched "raw.githubusercontent.com"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@enbox/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@enbox/[email protected]"],"fail_on":"high"}'

Publisheritsliran

Artifact bytes2,875,560

Previous version0.3.4

Published2026-04-26T21:37:23.402Z

SHA-25602ac3840e8d2b0980abe7593430a240ca7d9cd5c33cb4d68245723f8b9c403c9

Why flagged

What the scanner saw

Remote Payload: matched "raw.githubusercontent.com"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

19d agoLast checked

highRisk

75Score

0.3.5Version

Status history (1 event)

new → available19d ago · risk high · score 75 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

itsliran

4 members · evidence strength 73

Evidence

Static findings

19 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/browser.mjs	matched "raw.githubusercontent.com"	12
medium	Obfuscation Density	package/dist/browser.mjs	high encoded/escaped-token density	12

Show all 19 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/browser.mjs	matched "raw.githubusercontent.com"	12
medium	Obfuscation Density	package/dist/browser.mjs	high encoded/escaped-token density	12
low	Obfuscation	package/dist/browser.mjs	matched "\\u2604"	3
low	Obfuscation	package/dist/esm/src/state-index/state-index-level.js	matched "\\x00"	3
low	Obfuscation	package/dist/esm/src/store/index-level-compound.js	matched "\\x00"	3
low	Obfuscation	package/dist/esm/src/store/index-level.js	matched "\\u0000"	3
low	Obfuscation	package/dist/esm/src/store/level-wrapper.js	matched "fromCharCode"	3
low	Obfuscation	package/dist/esm/src/utils/filter.js	matched "\\uffff"	3
low	Obfuscation	package/dist/esm/src/utils/messages.js	matched "\\uffff"	3
low	Obfuscation	package/dist/esm/tests/fuzz/compound-index.fuzz.spec.js	matched "\\x00"	3
low	Obfuscation	package/dist/esm/tests/fuzz/filter.fuzz.spec.js	matched "\\uffff"	3
low	Obfuscation	package/dist/esm/tests/handlers/messages-subscribe.spec.js	matched "\\uffff"	3
low	Obfuscation	package/dist/esm/tests/utils/filters.spec.js	matched "\\uffff"	3
low	Obfuscation	package/src/state-index/state-index-level.ts	matched "\\x00"	3
low	Obfuscation	package/src/store/index-level-compound.ts	matched "\\x00"	3
low	Obfuscation	package/src/store/index-level.ts	matched "\\x01"	3
low	Obfuscation	package/src/store/level-wrapper.ts	matched "fromCharCode"	3
low	Obfuscation	package/src/utils/filter.ts	matched "\\uffff"	3
low	Obfuscation	package/src/utils/messages.ts	matched "\\uffff"	3

Manifest

Package metadata

Scripts17

buildbun run clean && bun run compile-validators && bun run build:esm && bun run bundle
build:esmtsc
bundlerm -rf dist/browser.mjs && bun ../../build/browser-bundle.js --node-shims --metafile
circular-dependency-checkdepcruise src
cleanrm -rf dist && rm -rf generated/*
compile-validatorsbun ./build/compile-validators.js
license-checklicense-report --only=prod > license-report.json && bun ./build/license-check.cjs
linteslint . --max-warnings 0
lint:fixeslint . --fix
publish:unstable./build/publish-unstable.sh
test:browserbun run compile-validators && bunx --bun vitest --config vitest.browser.config.ts --run
test:browser:coveragebun run compile-validators && bunx --bun vitest --config vitest.browser.config.ts --run --coverage --coverage.provider=istanbul
test:fuzzbun run compile-validators && bun test tests/fuzz/ .fuzz.spec.ts
test:fuzz-longbun run compile-validators && FAST_CHECK_NUM_RUNS=10000 bun test tests/fuzz/ .fuzz.spec.ts
test:nodebun run compile-validators && bun test .spec.ts
test:node-grepbun run compile-validators && bun test .spec.ts -t $GREP
test:node:coveragebun run compile-validators && bun test --coverage --coverage-reporter=text --coverage-reporter=lcov --coverage-dir=coverage .spec.ts

Dependencies21

@enbox/crypto0.1.0
@enbox/dids0.1.0
@ipld/dag-cbor9.0.5
@js-temporal/polyfill0.4.4
@noble/ciphers0.5.3
@noble/curves1.3.0
@noble/ed255192.0.0
@noble/secp256k12.0.0
abstract-level1.0.4
ajv8.18.0
interface-blockstore5.2.3
interface-store5.1.2
ipfs-unixfs-exporter13.1.5
ipfs-unixfs-importer15.1.5
level8.0.1
lodash4.17.21
lru-cache9.1.2
mitt3.0.1
multiformats11.0.2
uint8arrays5.1.0
ulidx2.1.0