Package evidence

@jackuait/[email protected]

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 719
Versions published: 123Established · −30% score
First published: Nov 2025
Publisher: jackuait

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@jackuait/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@jackuait/[email protected]"],"fail_on":"high"}'

Publisherjackuait

Artifact bytes16,958,296

Previous version0.18.0

Published2026-06-20T11:52:46.313Z

SHA-256857ae272396527a413a343b7444836b27bef4351febea485212cdc882c90ec38

Why flagged

What the scanner saw

1 candidate cluster(s) currently reference this release.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

4h agoLast checked

highRisk

35Score

0.19.0Version

Status history (1 event)

new → available4h ago · risk high · score 35 · status changed

Related candidates

Linked campaigns and clusters

Repeated static TTPactive

22 members · evidence strength 90

Repeated static TTPcandidate

22 members · max score 105

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Reverse Shell	package/dist/chunks/prism-bash-DDQ2u01V.cjs	matched "mkfifo\|mkfs\|mkisofs\|mknod\|mkswap\|mmv\|more\|most\|mount\|mtools\|mtr\|mutt\|mv\|nano\|nc\|netstat\|nice\|nl\|node\|nohup\|notify-send\|npm\|nslookup\|op\|open\|parted\|passwd\|paste\|pathchk\|ping\|pkill\|pnpm\|podman\|podman-compose\|popd\|pr\|printcap\|printenv\|ps\|pushd\|pv\|quota\|quotacheck\|quotactl\|ram\|rar\|rcp\|reboot\|remsync\|rename\|renice\|rev\|rm\|rmdir\|rpm\|rsync\|scp\|screen\|sdiff\|sed\|sendmail\|seq\|service\|sftp\|sh" — reverse-shell shape	40
high	Reverse Shell	package/dist/chunks/prism-bash-D4zr_u8t.mjs	matched "mkfifo\|mkfs\|mkisofs\|mknod\|mkswap\|mmv\|more\|most\|mount\|mtools\|mtr\|mutt\|mv\|nano\|nc\|netstat\|nice\|nl\|node\|nohup\|notify-send\|npm\|nslookup\|op\|open\|parted\|passwd\|paste\|pathchk\|ping\|pkill\|pnpm\|podman\|podman-compose\|popd\|pr\|printcap\|printenv\|ps\|pushd\|pv\|quota\|quotacheck\|quotactl\|ram\|rar\|rcp\|reboot\|remsync\|rename\|renice\|rev\|rm\|rmdir\|rpm\|rsync\|scp\|screen\|sdiff\|sed\|sendmail\|seq\|service\|sftp\|sh" — reverse-shell shape	40

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Reverse Shell	package/dist/chunks/prism-bash-DDQ2u01V.cjs	matched "mkfifo\|mkfs\|mkisofs\|mknod\|mkswap\|mmv\|more\|most\|mount\|mtools\|mtr\|mutt\|mv\|nano\|nc\|netstat\|nice\|nl\|node\|nohup\|notify-send\|npm\|nslookup\|op\|open\|parted\|passwd\|paste\|pathchk\|ping\|pkill\|pnpm\|podman\|podman-compose\|popd\|pr\|printcap\|printenv\|ps\|pushd\|pv\|quota\|quotacheck\|quotactl\|ram\|rar\|rcp\|reboot\|remsync\|rename\|renice\|rev\|rm\|rmdir\|rpm\|rsync\|scp\|screen\|sdiff\|sed\|sendmail\|seq\|service\|sftp\|sh" — reverse-shell shape	40
high	Reverse Shell	package/dist/chunks/prism-bash-D4zr_u8t.mjs	matched "mkfifo\|mkfs\|mkisofs\|mknod\|mkswap\|mmv\|more\|most\|mount\|mtools\|mtr\|mutt\|mv\|nano\|nc\|netstat\|nice\|nl\|node\|nohup\|notify-send\|npm\|nslookup\|op\|open\|parted\|passwd\|paste\|pathchk\|ping\|pkill\|pnpm\|podman\|podman-compose\|popd\|pr\|printcap\|printenv\|ps\|pushd\|pv\|quota\|quotacheck\|quotactl\|ram\|rar\|rcp\|reboot\|remsync\|rename\|renice\|rev\|rm\|rmdir\|rpm\|rsync\|scp\|screen\|sdiff\|sed\|sendmail\|seq\|service\|sftp\|sh" — reverse-shell shape	40
low	Large Javascript Payload	package/dist/blok.iife.js	3029730 bytes	0
low	Large Javascript Payload	package/dist/blok.umd.js	2890044 bytes	0

Manifest

Package metadata

Scripts42

buildnode scripts/generate-fonts.mjs && vite build --mode production && vite build --config vite.config.iife.mjs --mode production && vite build --config vite.config.umd.mjs --mode production && node scripts/build-locales.mjs
build:clinode scripts/build-cli.mjs
build:testnode scripts/generate-fonts.mjs && vite build --mode test && vite build --config vite.config.iife.mjs --mode test && vite build --config vite.config.umd.mjs --mode test && node scripts/build-locales.mjs test && node scripts/build-react-vendor.mjs
chromaticchromatic --exit-zero-on-changes
ci:timingnode scripts/ci-timing-probe.mjs
e2eyarn build:test && playwright test
e2e:chromeyarn build:test && playwright test --project=chromium
e2e:firefoxyarn build:test && playwright test --project=firefox
e2e:safariyarn build:test && playwright test --project=webkit
e2e:smokeyarn build:test && playwright test --project=chromium --grep="@smoke"
e2e:uiyarn build:test && playwright test --ui
e2e:ui:chromeyarn build:test && playwright test --ui --project=chromium
e2e:ui:firefoxyarn build:test && playwright test --ui --project=firefox
e2e:ui:safariyarn build:test && playwright test --ui --project=webkit
e2e:validate-categoriesnode scripts/validate-test-categories.mjs
i18n:auditnode scripts/i18n-audit.js
i18n:checknode scripts/i18n/check-translations.mjs
i18n:check:docsnode scripts/i18n/check-docs-translations.mjs
jscpdjscpd src/ test/
jscpd:reportjscpd . --reporters html,json --output .jscpd-report
lintsh -c 'eslint .; ESLINT_EXIT=$?; tsc --noEmit; TSC_EXIT=$?; if [ $ESLINT_EXIT -ne 0 ] || [ $TSC_EXIT -ne 0 ]; then exit 1; fi'
lint:fixeslint . --fix
lint:testseslint test/
lint:typestsc --noEmit
perf:analyzenode scripts/analyze-performance.mjs
perf:comparenode scripts/analyze-performance.mjs --baseline
perf:dashboardnode scripts/generate-performance-dashboard.mjs
preparehusky
prepublishOnlyyarn build
releasenode scripts/release.mjs
…and 12 more.

Dependencies6

mdast-util-from-markdown^2.0.3
mdast-util-gfm^3.1.0
mdast-util-math^3.0.0
micromark-extension-gfm^3.0.0
micromark-extension-math^3.1.0
nanoid5.1.9