Package evidence

@limetech/[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 3,953Niche · −30% score
Versions published: 1,267Mature · −50% score
First published: Jun 2019
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@limetech/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@limetech/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes5,154,792

Previous version39.28.2

Published2026-05-28T12:30:28.750Z

SHA-256858e54cdc02c3f167a3bce8004aa76994518d35765f411a24fa4ddb2edad26fe

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

20d agoLast checked

reviewRisk

14Score

39.29.0Version

Status history (1 event)

new → available20d ago · risk review · score 14 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Obfuscation Density	package/dist/cjs/index-BgFEL6FF.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/dist/esm/index-t4DgGbWS.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/dist/cjs/limel-file-viewer.cjs.entry.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/dist/esm/limel-file-viewer.entry.js	high encoded/escaped-token density	12

Manifest

Package metadata

Scripts19

api:updatenpm run build && node scripts/fix-tsdoc-tags.cjs && api-extractor run --local --verbose
api:verify(shx test -f src/components.d.ts || (npm run build && npm run build)) && node scripts/fix-tsdoc-tags.cjs && api-extractor run
buildcross-env-shell NODE_ENV=prod SASS_PATH=node_modules "stencil build --config stencil.config.dist.ts"
devcross-env-shell SASS_PATH=node_modules "stencil build --dev --docs"
docs:buildcross-env-shell NODE_ENV=prod SASS_PATH=node_modules "stencil build --docs --config stencil.config.docs.ts"
docs:context7node generate-context7-docs.cjs
docs:publishnode publish-docs.cjs
generatestencil generate
linteslint --max-warnings=0 && prettier -c --ignore-path .gitignore **/*.scss
lint:fixeslint --max-warnings=0 --fix && prettier --write --ignore-path .gitignore **/*.scss
startnpm run watch
testnpx playwright install chromium && stencil-test
test:e2enpx playwright install chromium && stencil-test --project e2e
test:specstencil-test --project spec
test:watchnpx playwright install chromium && stencil-test --watch
test:watch:e2enpx playwright install chromium && stencil-test --watch --project e2e
test:watch:specstencil-test --watch --project spec
watchcross-env-shell SASS_PATH=node_modules "stencil build --dev --watch --docs --serve"
watch:prodshx rm -rf www/ && cross-env-shell SASS_PATH=node_modules "stencil build --watch"

Dependencies2

diff^8.0.3
sortablejs^1.15.6