PkgRadar

Package evidence

@hyperfixi/[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@hyperfixi/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@hyperfixi/[email protected]"],"fail_on":"high"}'
PublisherGitHub Actions
Artifact bytes4,668,333
Previous version2.4.0
Published2026-05-22T15:31:52.450Z
SHA-256e0dd294b3485c12a47e1e6919624a99946f224ffb18128e0917efe2230542714

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
86Score
2.5.0Version
Status history (1 event)
  1. new → available · risk high · score 86 · status changed

Evidence

Static findings

18 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/ast-utils/index.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/ast-utils/index.mjshigh encoded/escaped-token density12
mediumLarge Javascript Payloadpackage/dist/index.js2775853 bytes10
mediumLarge Javascript Payloadpackage/dist/index.mjs2774351 bytes10
Show all 18 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/ast-utils/index.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/ast-utils/index.mjshigh encoded/escaped-token density12
mediumLarge Javascript Payloadpackage/dist/index.js2775853 bytes10
mediumLarge Javascript Payloadpackage/dist/index.mjs2774351 bytes10
lowObfuscationpackage/dist/chunks/browser-modular-D5vPrb2X.jsmatched "\\u064B"3
lowObfuscationpackage/dist/parser/full-parser.jsmatched "\\u2019"3
lowObfuscationpackage/dist/hyperfixi-browser.jsmatched "\\u064B"3
lowObfuscationpackage/dist/hyperfixi-hx-v4.jsmatched "\\u064B"3
lowObfuscationpackage/dist/hyperfixi.jsmatched "\\u064B"3
lowObfuscationpackage/dist/ast-utils/index.jsmatched "\\u300C"3
lowObfuscationpackage/dist/commands/index.jsmatched "\\u2019"3
lowObfuscationpackage/dist/registry/index.jsmatched "\\u2019"3
lowObfuscationpackage/dist/index.min.jsmatched "\\u064B"3
lowObfuscationpackage/dist/lokascript-browser.jsmatched "\\u064B"3
lowObfuscationpackage/dist/parser/full-parser.mjsmatched "\\u2019"3
lowObfuscationpackage/dist/ast-utils/index.mjsmatched "\\u300C"3
lowObfuscationpackage/dist/commands/index.mjsmatched "\\u2019"3
lowObfuscationpackage/dist/registry/index.mjsmatched "\\u2019"3

Manifest

Package metadata

Scripts62
  • analyze:usagenode scripts/analyze-usage.mjs
  • benchvitest bench
  • bench:civitest bench --run --reporter=json --outputFile=benchmark-results/latest.json
  • bench:runvitest bench --run
  • buildrollup -c && rollup -c rollup.parser-modules.config.mjs && tsc -p tsconfig.build.json
  • build:browsernode scripts/build-browser-bundles.mjs
  • build:browser:allnpm run build:browser:dev && npm run build:browser:prod && npm run build:browser:llm && npm run build:browser:lite && npm run build:browser:minimal && npm run build:browser:standard && npm run build:browser:classic && npm run build:browser:classic-i18n && npm run build:browser:multilingual && npm run build:browser:semantic-complete
  • build:browser:classicrollup -c rollup.browser-classic.config.mjs
  • build:browser:classic-i18nrollup -c rollup.browser-classic-i18n.config.mjs
  • build:browser:devrollup -c rollup.browser.dev.config.mjs
  • build:browser:hybrid-completerollup -c rollup.browser-hybrid-complete.config.mjs
  • build:browser:hybrid-hxrollup -c rollup.browser-hybrid-hx.config.mjs
  • build:browser:hybrid-hx-v4rollup -c rollup.browser-hybrid-hx-v4.config.mjs
  • build:browser:literollup -c rollup.browser-lite.config.mjs
  • build:browser:lite-plusrollup -c rollup.browser-lite-plus.config.mjs
  • build:browser:llmrollup -c rollup.browser.llm.config.mjs
  • build:browser:main-onlyrollup -c rollup.browser.config.mjs
  • build:browser:minimalrollup -c rollup.browser-minimal.config.mjs
  • build:browser:modularrollup -c rollup.browser-modular.config.mjs
  • build:browser:multilingualrollup -c rollup.browser-multilingual.config.mjs
  • build:browser:prodrollup -c rollup.browser.prod.config.mjs
  • build:browser:semantic-completerollup -c rollup.browser-semantic-complete.config.mjs
  • build:browser:standardrollup -c rollup.browser-standard.config.mjs
  • build:parser-modulesrollup -c rollup.parser-modules.config.mjs
  • build:typestsc -p tsconfig.build.json
  • check:dist-freshnessnode scripts/check-dist-freshness.mjs
  • cleanrm -rf dist
  • devrollup -c -w
  • generate:bundletsx scripts/generate-inline-bundle.ts
  • generate:bundle:textshelftsx scripts/generate-inline-bundle.ts --config bundle-configs/textshelf.config.json
  • …and 32 more.
Dependencies4
  • @lokascript/intent^2.5.0
  • @lokascript/semantic^2.5.0
  • morphlex^1.0.5
  • tslib^2.8.1