Package evidence

@kodax-ai/[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 6
First published: May 2026
Publisher: icetomoyo

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@kodax-ai/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@kodax-ai/[email protected]"],"fail_on":"review"}'

Publishericetomoyo

Artifact bytes1,593,903

Previous version0.7.43

Published2026-05-29T06:55:04.734Z

SHA-256cae311470784e73bc8736f09abee00c63057cc4e2caa42f8bf51b3f9f9b8ab51

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low

15d agoLast checked

lowRisk

0Score

0.7.44Version

Status history (1 event)

new → available15d ago · risk low · score 0 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Obfuscation Density	package/dist/chunks/chunk-35BDEEC5.js	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts22

bench:perftsx benchmark/perf/repl-render-perf.bench.ts
bench:perf:e2etsx benchmark/perf/repl-render-engine-e2e.bench.ts
buildnpm run build:packages && npm run build:bundle && npm run build:dts
build:binarynode scripts/build-binary.mjs
build:binary:allnode scripts/build-binary.mjs --all
build:bundlenode scripts/build-bundle.mjs
build:dtsnode scripts/build-dts.mjs
build:packagestsc -b tsconfig.build.json && npm run copy:builtin -w @kodax-ai/agent && npm run copy:provider-caps -w @kodax-ai/llm
cleannode -e "require('fs').rmSync('dist',{recursive:true,force:true})"
clean:packagesnpm run clean --workspaces
devnode --max-old-space-size=4096 --require ./scripts/production-env.cjs --import tsx src/kodax_cli.ts
dev:clinode --max-old-space-size=4096 --require ./scripts/production-env.cjs --import tsx src/kodax_cli.ts
dev:mem-diagnode scripts/mem-diag-launch.cjs
dev:mem-snapshotnode scripts/mem-diag-launch.cjs 2
probe:reasoningtsx scripts/probe-reasoning.ts
repointel:demonode clients/repointel/scripts/demo.mjs
repointel:doctornode clients/repointel/scripts/doctor.mjs
repointel:installnode clients/repointel/scripts/install.mjs
startnode --max-old-space-size=4096 --require ./scripts/production-env.cjs dist/kodax_cli.js
testvitest run
test:evalvitest run -c vitest.eval.config.ts
test:watchvitest

Dependencies43

@agentclientprotocol/sdk^0.15.0
@alcalzone/ansi-tokenize^0.2.5
@anthropic-ai/sdk^0.80.0
ansi-escapes^7.3.0
auto-bind^5.0.1
chalk^5.4.1
cli-boxes^3.0.0
cli-cursor^4.0.0
cli-truncate^5.2.0
clipboardy^4.0.0
code-excerpt^4.0.0
commander^13.1.0
es-toolkit^1.46.1
fflate^0.8.2
glob^11.0.1
iconv-lite^0.6.3
indent-string^5.0.0
ink^6.7.0
ink-spinner^5.0.0
ink-text-input^6.0.0
is-in-ci^2.0.0
jimp^1.6.0
js-tiktoken^1.0.12
openai^6.32.0
partial-json^0.1.7
patch-console^2.0.0
react>=19.0.0
react-devtools-core^7.0.1
react-reconciler^0.33.0
scheduler^0.27.0
…and 13 more.