PkgRadar

Package evidence

@evalops/[email protected]

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
3,848Niche · −30% score
Versions published
36
First published
Apr 2026
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@evalops/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@evalops/[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes8,417,723
Previous version0.10.47
Published2026-05-30T05:55:49.081Z
SHA-256f3c6fd9bd6cc365a49e775a1144a9eb70eb4c00c929cc4155f1367b553208434

Why flagged

What the scanner saw

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
45Score
0.10.48Version
Status history (1 event)
  1. new → available · risk review · score 45 · status changed

Evidence

Static findings

15 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highJs Split Join Obfuscationpackage/dist/safety/credential-patterns.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
highJs Split Join Obfuscationpackage/dist/memory/team-memory-secret-scan.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
highCredential file accesspackage/dist/oauth/command-key.jsmatched "AWS_ACCESS_KEY"30
highInstall Lifecycle Remote Or Execpackage.jsonpostinstall="node -e \"const fs=require('node:fs');const cp=require('node:child_process');if(!fs.existsSync('./scripts/ensure-deps.js')||!fs.existsSync('./packages/contracts/package.json'))process.exit(0);const r=cp.spawnSync(process.execPath,['./scripts/ensure-deps.js','--no-install'],{stdio:'inherit'});process.exit(r.status??1);\""30
mediumCredential file accesspackage/dist/agent/providers/google.jsmatched "AWS_ACCESS_KEY"10
Show all 15 findings (low-signal and informational)
SeverityKindPathDetailPoints
highJs Split Join Obfuscationpackage/dist/safety/credential-patterns.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
highJs Split Join Obfuscationpackage/dist/memory/team-memory-secret-scan.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
highCredential file accesspackage/dist/oauth/command-key.jsmatched "AWS_ACCESS_KEY"30
highInstall Lifecycle Remote Or Execpackage.jsonpostinstall="node -e \"const fs=require('node:fs');const cp=require('node:child_process');if(!fs.existsSync('./scripts/ensure-deps.js')||!fs.existsSync('./packages/contracts/package.json'))process.exit(0);const r=cp.spawnSync(process.execPath,['./scripts/ensure-deps.js','--no-install'],{stdio:'inherit'});process.exit(r.status??1);\""30
mediumCredential file accesspackage/dist/agent/providers/google.jsmatched "AWS_ACCESS_KEY"10
lowCredential file accesspackage/dist/providers/api-keys.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/dist/providers/aws-auth.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/dist/cli/commands/config.jsmatched "GOOGLE_APPLICATION_CREDENTIALS"5
lowCredential file accesspackage/dist/cli-tui/commands/subcommands/diag-commands.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/dist/agent/providers/google-gemini-cli.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/dist/node_modules/@evalops/contracts/dist/guarded-files-settings.jsmatched ".ssh/"5
lowCredential file accesspackage/dist/security/pii-detector.jsmatched "aws_access_key"5
lowCredential file accesspackage/dist/agent/providers/vertex.jsmatched "AWS_ACCESS_KEY"5
lowInstall-time lifecycle scriptpackage.jsonpostinstall="node -e \"const fs=require('node:fs');const cp=require('node:child_process');if(!fs.existsSync('./scripts/ensure-deps.js')||!fs.existsSync('./packages/contracts/package.json'))process.exit(0);const r=cp.spawnSync(process.execPath,['./scripts/ensure-deps.js','--no-install'],{stdio:'inherit'});process.exit(r.status??1);\""5
lowLarge Javascript Payloadpackage/dist/cli.js7227010 bytes0

Manifest

Package metadata

Scripts149
  • a2atsx src/cli.ts a2a
  • a2a:codex-bridgepython3 scripts/codex-a2a-bridge.py
  • a2a:peertsx src/cli.ts a2a
  • buildnode ./scripts/ensure-dir.js ./tmp/tsbuildinfo && tsc -b tsconfig.build.json --force && bun build ./src/cli.ts --target node --packages external --external tree-sitter --external tree-sitter-bash --outfile dist/cli.js && node ./scripts/bundle-runtime-deps.mjs && node ./scripts/copy-themes.js && node ./scripts/copy-db-migrations.js
  • build:allbun run --filter @evalops/contracts build && bun run --filter @evalops/consumer build && bun run --filter @evalops/tui build && bun run --filter @evalops/maestro-web build && bun run build && bun run --filter @evalops/ai build
  • bun:checkbun run bun:lint && bunx tsc -p tsconfig.build.json --noEmit
  • bun:clibun run ./src/cli.ts
  • bun:compilenpm run build && bun build ./dist/cli.js --compile --external tree-sitter --external tree-sitter-bash --outfile dist/maestro-bun
  • bun:compile:bytecodenpm run build && bun build ./dist/cli.js --compile --bytecode --external tree-sitter --external tree-sitter-bash --outfile dist/maestro-bun-bytecode
  • bun:evalsbun run build && bun run ./scripts/run-evals.js
  • bun:installbun install
  • bun:lintbunx biome check . && bun run lint:evals
  • bun:testnode ./scripts/run-vitest.js --run
  • bun:test:fastVITEST_FAST=1 node ./scripts/run-vitest.js --run
  • bun:watchbun run --watch ./src/cli.ts
  • checknpm run lint && npm run check --workspaces --if-present && tsc -p tsconfig.build.json --noEmit
  • check:agent-trajectory-fixturestsx scripts/check-agent-trajectory-fixtures.ts
  • check:agent-trajectory-inspection-fixturestsx scripts/check-agent-trajectory-inspection-fixtures.ts
  • check:agent-trajectory-replay-fixturestsx scripts/check-agent-trajectory-replay-fixtures.ts
  • check:agent-trajectory-scenario-fixturestsx scripts/check-agent-trajectory-scenario-fixtures.ts
  • check:agent-trajectory-score-fixturestsx scripts/check-agent-trajectory-score-fixtures.ts
  • check:app-server-schematsx scripts/app-server-schema-codegen.ts --check
  • check:cli-runtime-conformancetsx scripts/check-cli-runtime-conformance.ts
  • check:codex-operating-layernode scripts/check-codex-operating-layer-conformance.mjs
  • check:codex-paritynode scripts/check-codex-parity-conformance.mjs
  • check:context-manifesttsx scripts/check-context-manifest-contract.ts
  • check:drift-surfacesnode scripts/check-drift-prone-surfaces.mjs
  • check:evidence-integritytsx scripts/check-evidence-integrity.ts
  • check:headless-proto:generatednode scripts/check-headless-proto-generated.mjs
  • check:maestro-release-gate-eventstsx scripts/check-maestro-release-gate-events.ts
  • …and 119 more.
Dependencies49
  • @aws-sdk/client-bedrock-runtime^3.1020.0
  • @bufbuild/protobuf^2.11.0
  • @crosscopy/clipboard^0.2.8
  • @modelcontextprotocol/sdk^1.29.0
  • @openai/codex^0.135.0
  • @opentelemetry/api^1.9.1
  • @opentelemetry/auto-instrumentations-node^0.76.0
  • @opentelemetry/resources^2.7.1
  • @opentelemetry/sdk-node0.218.0
  • @opentelemetry/semantic-conventions^1.41.1
  • @sentry/node^10.53.1
  • @sinclair/typebox^0.34.49
  • ajv^8.18.0
  • ajv-formats^3.0.1
  • bcrypt^6.0.0
  • chalk^5.6.2
  • clipboardy^4.0.0
  • diff^8.0.4
  • dotenv^16.6.1
  • drizzle-orm0.45.2
  • exceljs^4.4.0
  • fflate^0.8.2
  • glob^13.0.6
  • ioredis^5.10.1
  • jiti^2.6.1
  • jose^6.2.2
  • js-yaml^4.1.1
  • jsonc-parser^3.3.1
  • jsonwebtoken^9.0.3
  • jszip^3.10.1
  • …and 19 more.
Optional dependencies3
  • sharp0.34.5
  • tree-sitter^0.25.0
  • tree-sitter-bash^0.25.1