PkgRadar

Package evidence

@mercuryo-ai/[email protected]

Obfuscation: matched "\\u200B"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
14
First published
May 2026
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@mercuryo-ai/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@mercuryo-ai/[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes265,558
Previous version0.0.12
Published2026-05-22T16:23:10.831Z
SHA-256b5f06a2dde1eb687e53a917040e51c1acdc8b654d181fdedf72eddd9fa0a519e

Why flagged

What the scanner saw

Obfuscation: matched "\\u200B"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
3Score
0.0.13Version
Status history (1 event)
  1. new → available · risk review · score 3 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 4 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowObfuscationpackage/dist/vendor/services/guardrails/sanitizer.jsmatched "\\u200B"3
lowCredential file accesspackage/dist/adapter/i18n/locales/en/messages.jsonmatched ".azure"3
lowCredential file accesspackage/dist/adapter/i18n/locales/pt_BR/messages.jsonmatched ".azure"3
lowCredential file accesspackage/dist/adapter/i18n/locales/zh_TW/messages.jsonmatched ".azure"3

Manifest

Package metadata

Scripts12
  • buildnode -e "require('node:fs').rmSync('dist',{ recursive: true, force: true, maxRetries: 10, retryDelay: 50 })" && tsc -p tsconfig.build.json && node -e "const fs=require('node:fs');fs.mkdirSync('dist/vendor',{recursive:true});fs.copyFileSync('src/vendor/buildDomTree.js','dist/vendor/buildDomTree.js');fs.copyFileSync('src/vendor/NANOBROWSER_SHA','dist/vendor/NANOBROWSER_SHA');fs.cpSync('src/adapter/i18n/locales','dist/adapter/i18n/locales',{recursive:true})"
  • check-typestsc --noEmit
  • testpnpm run test:unit && pnpm run test:browser-fixture && pnpm run test:browser-reliability
  • test:allpnpm run test:unit && pnpm run test:contract && pnpm run test:runtime && pnpm run test:browser-fixture && pnpm run test:browser-reliability && pnpm run test:protected-safety
  • test:browser-fixturevitest run --passWithNoTests --no-file-parallelism --maxWorkers=1 src/browser/dom-service.integration.test.ts src/browser/browser-context.integration.test.ts src/vendor/browser/page.integration.test.ts src/__tests__/preflight.buildDomTree.smoke.test.ts src/__tests__/browser-fixture-matrix.integration.test.ts src/__tests__/agentbrowse-pain-port.integration.test.ts
  • test:browser-reliabilityvitest run --passWithNoTests src/__tests__/magicbrowse-reliability-p0.integration.test.ts src/__tests__/magicbrowse-reliability-regression.integration.test.ts
  • test:contractvitest run --passWithNoTests src/index.test.ts src/__tests__/nanobrowser-cutover-boundary.test.ts src/runtime/execute-observe.test.ts src/resolution/targets.test.ts src/resolution/resolve-field.test.ts src/resolution/resolve-field.contract.test.ts src/resolution/open-data-match.contract.test.ts src/resolution/match.contract.test.ts src/resolution/open-data-resolver.contract.test.ts src/resolution/fill-open-data.contract.test.ts src/resolution/protected-fields.test.ts src/resolution/protected-projection.test.ts src/resolution/value-projection.test.ts src/resolution/fill-protected.contract.test.ts
  • test:livevitest run --passWithNoTests src/__tests__/api.live-config.test.ts src/__tests__/api.live.test.ts
  • test:protected-safetyvitest run --passWithNoTests src/redaction.test.ts src/transport/run-store.test.ts src/transport/run-store-redaction-complexity.test.ts src/vendor/services/guardrails/guardrails.test.ts src/resolution/resolve-field.test.ts src/resolution/resolve-field.contract.test.ts src/resolution/protected-projection.test.ts src/resolution/value-projection.test.ts src/resolution/fill-protected.contract.test.ts
  • test:real-browservitest run --passWithNoTests src/__tests__/real-browser-env.test.ts src/__tests__/real-browser.smoke.test.ts
  • test:runtimevitest run --passWithNoTests src/transport/session-store.test.ts src/transport/browserbase-client.test.ts src/transport/owned-browser-launcher.test.ts src/transport/page-resolver.test.ts src/transport/run-store.test.ts src/transport/run-store-redaction-complexity.test.ts src/transport/agent-session-store.test.ts src/transport/session-manager.test.ts src/transport/stealth-client.test.ts src/llm/create-llm.test.ts src/runtime/execute-act.test.ts src/runtime/execute-observe.test.ts
  • test:unitvitest run --passWithNoTests src/index.test.ts src/transport/session-store.test.ts src/transport/browserbase-client.test.ts src/transport/owned-browser-launcher.test.ts src/transport/page-resolver.test.ts src/transport/run-store.test.ts src/transport/run-store-redaction-complexity.test.ts src/transport/agent-session-store.test.ts src/transport/session-manager.test.ts src/transport/stealth-client.test.ts src/llm/create-llm.test.ts src/browser/browser-context.unit.test.ts src/redaction.test.ts src/adapter/logger.test.ts src/adapter/i18n.test.ts src/vendor/services/guardrails/guardrails.test.ts src/resolution/targets.test.ts src/resolution/resolve-field.test.ts src/resolution/resolve-field.contract.test.ts src/resolution/open-data-match.contract.test.ts src/resolution/match.contract.test.ts src/resolution/open-data-resolver.contract.test.ts src/resolution/fill-open-data.contract.test.ts src/resolution/protected-fields.test.ts src/resolution/protected-projection.test.ts src/resolution/value-projection.test.ts src/resolution/fill-protected.contract.test.ts src/vendor/browser/util.test.ts src/vendor/browser/page.unit.test.ts src/runtime/execute-act.test.ts src/runtime/execute-observe.test.ts src/__tests__/nanobrowser-cutover-boundary.test.ts src/__tests__/magicbrowse-reliability-manifest.test.ts src/vendor/agent/event/manager.test.ts src/vendor/agent/agents/navigator.test.ts src/vendor/browser/dom/clickable/service.test.ts src/vendor/agent/messages/service.test.ts src/vendor/agent/messages/views.test.ts src/vendor/agent/executor.test.ts src/vendor/browser/dom/parse.test.ts src/vendor/browser/dom/views.test.ts src/vendor/browser/dom/cross-frame.test.ts src/vendor/browser/dom/history/service.test.ts src/vendor/agent/prompts/browser-state-description.test.ts src/vendor/agent/prompts/templates/planner.test.ts src/vendor/agent/actions/schemas.test.ts src/vendor/agent/actions/builder.test.ts
Dependencies16
  • @langchain/anthropic0.3.27
  • @langchain/cerebras0.0.4
  • @langchain/core0.3.80
  • @langchain/deepseek0.1.0
  • @langchain/google-genai0.2.16
  • @langchain/groq0.2.4
  • @langchain/ollama0.2.4
  • @langchain/openai0.6.16
  • @langchain/xai0.1.0
  • jsonrepair^3.13.1
  • libphonenumber-js^1.12.41
  • puppeteer-core^23.11.1
  • puppeteer-extra^3.3.6
  • puppeteer-extra-plugin-stealth^2.11.2
  • zod^3.24.0
  • zod-to-json-schema^3.24.6