Package evidence

@lakphy/[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 710
Versions published: 21
First published: Mar 2026
Publisher: lakphy

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@lakphy/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@lakphy/[email protected]"],"fail_on":"review"}'

Publisherlakphy

Artifact bytes1,136,581

Previous version0.5.2

Published2026-05-23T07:06:21.460Z

SHA-256b27fdc69f3ade5cdeda39fc655f166b6b200e277bb8e19f5a2f2c084bf2d2c52

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

18d agoLast checked

reviewRisk

32Score

0.5.3Version

Status history (1 event)

new → available18d ago · risk review · score 32 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Obfuscation Density	package/dist/index.js	high encoded/escaped-token density	12
medium	Large Javascript Payload	package/dist/cli.js	2241072 bytes	10
medium	Large Javascript Payload	package/dist/entry.js	2073329 bytes	10

Manifest

Package metadata

Scripts16

buildbun run build:api & bun run build:web & bun run build:cli & wait
build:apibun build src/entry.ts --target bun --outdir dist
build:clibun build src/cli.ts --target bun --outfile dist/cli.js
build:webcd web && bun run build
checkbiome check .
check:fixbiome check --write .
devbun run dev:api & bun run dev:web
dev:apiNO_PROXY=localhost,127.0.0.1,::1 no_proxy=localhost,127.0.0.1,::1 PORT=4099 ADMIN_DEV_SERVER_URL=http://localhost:5177 bun run --hot src/entry.ts
dev:webcd web && bun run dev
formatbiome format .
format:fixbiome format --write .
lintbiome lint .
lint:fixbiome lint --write .
prepublishOnlybun run build
startbun run dist/cli.js start
testbun test

Dependencies5

@hono/swagger-ui^0.5.3
ajv^8.18.0
ajv-formats^3.0.1
hono^4.12.3
json5^2.2.3