Package evidence

@feedmepos/[email protected]

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 513
Versions published: 651Mature · −50% score
First published: Jun 2024
Publisher: lokingwei

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@feedmepos/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@feedmepos/[email protected]"],"fail_on":"high"}'

Publisherlokingwei

Artifact bytes6,294,304

Previous version0.32.50-dev.1

Published2026-06-12T10:13:06.941Z

SHA-2567dead3ff3015ae7725cc1f2ec230805eafcd8caee58d778ca907d6ddc4d6a4e9

Why flagged

What the scanner saw

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

29h agoLast checked

highRisk

26Score

0.32.51-devVersion

Status history (1 event)

new → available29h ago · risk high · score 26 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Js Split Join Obfuscation	package/dist/App-DJ_boY0P.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40
high	Remote Dependency Spec	package.json	dependencies.@feedmepos/mf-inventory-portal="https://registry.npmjs.org/@feedmepos/mf-inventory-portal/-/mf-inventory-portal-0.0.19-dev.6.tgz"	12

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Js Split Join Obfuscation	package/dist/App-DJ_boY0P.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40
high	Remote Dependency Spec	package.json	dependencies.@feedmepos/mf-inventory-portal="https://registry.npmjs.org/@feedmepos/mf-inventory-portal/-/mf-inventory-portal-0.0.19-dev.6.tgz"	12
low	Large Javascript Payload	package/dist/ImportProductDialog.vue_vue_type_script_setup_true_lang-Cu2_U6gg.js	3450582 bytes	0
low	Large Javascript Payload	package/dist/index.vue_vue_type_script_setup_true_lang-CbJ4htzZ.js	7651838 bytes	0

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
dependencies.@feedmepos/mf-inventory-portal	https://registry.npmjs.org/@feedmepos/mf-inventory-portal/-/mf-inventory-portal-0.0.19-dev.6.tgz	low	0	large_javascript_payload: 3264378 bytes

Manifest

Package metadata

Scripts17

buildrun-p type-check "build-only {@}" --
build-onlypnpm build:mf && pnpm build:dts && echo 'Build completed'
build:devdotenv -e .env.dev pnpm build-only
build:dtsvue-tsc --declaration --emitDeclarationOnly -p tsconfig.app.json --outDir ./dist
build:mfvite build --mode fmmf
build:proddotenv -e .env.prod pnpm build-only
deploypnpm publish --no-git-checks .
devvite --mode dev --port 5176
dev:proddotenv -e .env.prod -- vite --mode dev --port 5176
formatprettier --write src/
linteslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore
prepare-menu-debugbash scripts/prepare-menu-debug.sh
publish-npmpnpm build && pnpm publish --no-git-checks
testvitest
test:coveragevitest --coverage
test:uivitest --ui
type-checkvue-tsc --noEmit -p tsconfig.app.json --composite false

Dependencies42

@feedmepos/auth^1.1.14
@feedmepos/core2.15.22
@feedmepos/core-dart^0.2.6
@feedmepos/core-legacyfile:../../core-legacy-1.5.tar.gz
@feedmepos/custom-attributes0.0.1-rc.4
@feedmepos/entity0.0.11
@feedmepos/feature-flag^0.0.15
@feedmepos/hrm-permission1.0.6-dev.2
@feedmepos/inventory-core^0.2.6
@feedmepos/menu2.0.1
@feedmepos/mf-common^1.29.23
@feedmepos/mf-inventory-portalhttps://registry.npmjs.org/@feedmepos/mf-inventory-portal/-/mf-inventory-portal-0.0.19-dev.6.tgz
@feedmepos/mf-remy-panel^0.3.5
@feedmepos/ui-library1.8.8
@feedmepos/zod-entity0.0.4-alpha.9
@types/dinero.js^1.9.4
@vue/devtools-api^6.5.0
@vueuse/core^10.11.0
axios^1.7.2
canvas^2.9.3
change-case^5.4.4
dayjs^1.11.12
dinero.js^1.9.1
dotenv-cli^7.4.2
exceljs^4.4.0
file-saver^2.0.5
firebase^10.12.4
i18next^23.11.5
i18next-vue^4.0.0
jszip^3.10.1
…and 12 more.