Package evidence

@keepur/[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 217
Versions published: 40
First published: Apr 2026
Publisher: may-keepur

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@keepur/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@keepur/[email protected]"],"fail_on":"review"}'

Publishermay-keepur

Artifact bytes1,295,978

Previous version0.7.0

Published2026-05-18T09:55:32.678Z

SHA-256887d57ce9208fbf9f305f01bc061f3e4ebd953d7ddfa268997f4a95747a10ecc

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

18d agoLast checked

reviewRisk

79Score

0.8.0Version

Status history (1 event)

new → available18d ago · risk review · score 79 · status changed

Evidence

Static findings

19 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Obfuscation Density	package/pkg/mcp/background-task.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/clickup.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/code-task.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/github-issues.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/google.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/keychain.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/linear.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/quo.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/recall.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/resend.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/search-conversation.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/server.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/skill-author.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/slack.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/task.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/voice.min.js	high encoded/escaped-token density	12
medium	Remote Payload	package/service/deploy.sh	matched "curl "	12
medium	Remote Payload	package/install/migrate-0.2.sh	matched "curl "	12

Show all 19 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Obfuscation Density	package/pkg/mcp/background-task.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/clickup.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/code-task.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/github-issues.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/google.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/keychain.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/linear.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/quo.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/recall.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/resend.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/search-conversation.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/server.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/skill-author.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/slack.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/task.min.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/pkg/mcp/voice.min.js	high encoded/escaped-token density	12
medium	Remote Payload	package/service/deploy.sh	matched "curl "	12
medium	Remote Payload	package/install/migrate-0.2.sh	matched "curl "	12
low	Credential file access	package/pkg/mcp/keychain.min.js	matched "GITHUB_TOKEN"	5

Manifest

Package metadata

Scripts28

buildtsc
bundlenpm run build && npx tsx build/bundle.ts
checknpm run typecheck && npm run lint && npm run format:check && npm run test
check:bundlenpm run bundle && node scripts/check-bundle-strings.mjs && node scripts/check-bundle-pack.mjs && node scripts/check-bundle-runtime.mjs
devnpx tsx src/index.ts
formatprettier --write "src/**/*.ts" "setup/**/*.ts"
format:checkprettier --check "src/**/*.ts" "setup/**/*.ts"
linteslint src/ setup/
lint:fixeslint --fix src/ setup/
migrate:agents:add-rolesnpx tsx scripts/migrate-agents-add-roles.ts
migrate:agents:legacynpx tsx setup/migrate-agents.ts
migrate:contacts-categoriesnpx tsx scripts/migrate-contacts-categories.ts
migrate:split-crm-contactsnpx tsx setup/migrate-split-crm-contacts.ts
postversiongit push --follow-tags
prepublishOnlynpm run bundle
reindexnpx tsx scripts/code-index.ts
setupnpx tsx src/cli.ts init
setup:constitutionnpx tsx setup/setup-constitution.ts
setup:instancenpx tsx setup/setup-instance.ts
setup:plistnpx tsx setup/generate-plist.ts
setup:pluginsnpx tsx setup/sync-plugins.ts
setup:seedsnpx tsx setup/setup-seeds.ts
startnode dist/index.js
testvitest run
test:coveragevitest run --coverage
test:watchvitest
typechecktsc --noEmit
updategit pull && npm install && npm run build

Dependencies17

@anthropic-ai/claude-agent-sdk^0.2.63
@anthropic-ai/sdk^0.82.0
@linear/sdk^76.0.0
@modelcontextprotocol/sdk^1.27.1
@qdrant/js-client-rest^1.17.0
@slack/socket-mode^2.0.5
@slack/web-api^7.14.1
better-sqlite3^12.8.0
brave-search-mcp^2.0.1
csv-parse^6.1.0
dotenv^17.3.1
mammoth^1.11.0
mongodb^7.1.0
pdf-parse^2.4.5
ws^8.19.0
xlsx^0.18.5
yaml^2.8.2