Package evidence
@kne-components/[email protected]
Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 321
- Versions published
- 264Mature · −50% score
- First published
- Feb 2024
- Publisher
- lingtong
Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@kne-components/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@kne-components/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 51 · status changed
Evidence
Static findings
6 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Js Decode Then Exec | package/build/static/js/6351.a1c97c9b.chunk.js | base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern. | 45 |
| medium | Obfuscation Density | package/build/static/js/2833.9ab90527.chunk.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/build/static/js/4965.2167f384.chunk.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/build/static/js/7591.e5252eff.chunk.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/build/static/js/7901.efe08627.chunk.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/build/static/js/2488.61fab196.chunk.js | 4404908 bytes | 10 |
Manifest
Package metadata
Scripts5
buildcross-env COMPONENTS_NAME=components-core MODULES_DEV_PUBLIC_URL=/components-core craco buildcreatemodules-dev-createlint-stagedlint-stagedstartcross-env PORT=3001 COMPONENTS_NAME=components-core MODULES_DEV_PUBLIC_URL=/ craco starttestcraco test --coverage
Dependencies52
@kne/button-group^0.1.24@kne/compose^0.1.0@kne/create-deferred^0.1.0@kne/ensure-slash^0.1.0@kne/flex-box^0.1.1@kne/form-info^0.1.9@kne/global-context^1.3.2@kne/info-page^0.2.10@kne/is-empty^1.0.1@kne/phone-number-input^0.1.5@kne/react-enum^0.1.14@kne/react-fetch^1.5.5@kne/react-file^0.1.35@kne/react-file-type^1.0.5@kne/react-form-antd^4.1.0@kne/react-form-plus^0.1.5@kne/react-icon^0.1.3@kne/react-intl^0.1.12@kne/react-pdf-sign^1.1.6@kne/react-text-escape^0.1.4@kne/remote-loader^1.2.2@kne/scroll-loader^0.1.13@kne/super-select^0.1.32@kne/use-click-outside^0.2.1@kne/use-control-value^0.1.7@kne/use-ref-callback^0.1.2@kne/use-resize^0.1.1@kne/use-simulation-blur^0.1.2@testing-library/jest-dom^5.16.5@testing-library/react^13.4.0- …and 22 more.