PkgRadar

Package evidence

@myoc/[email protected]

Remote Payload: matched "raw.githubusercontent.com"

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@myoc/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@myoc/[email protected]"],"fail_on":"high"}'
Publisherfengsight
Artifact bytes31,943,205
Previous version0.19.508
Published2026-05-24T07:56:22.001Z
SHA-256deef78cb9ba151024b8aa1fee05482d9a9ca041a36920865c537e15c9bfefedf

Why flagged

What the scanner saw

Remote Payload: matched "raw.githubusercontent.com"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
1569Score
0.19.509Version
Status history (1 event)
  1. newavailable · risk high · score 1569 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

fengsight

2 members · evidence strength 64

Evidence

Static findings

217 static · 0 from release diff · showing high-signal first.

Showing 30 of 102 findings.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/prod/index.jsmatched "raw.githubusercontent.com"12
mediumObfuscation Densitypackage/dist/prod/index.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ar-SA-U3PIVEZH.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/az-AZ-COAM4HVM.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/bg-BG-D6B2W7JL.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/bn-BD-BU7GZAZW.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/bn-IN-MYKDEVNA.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ca-ES-GEEW5L7T.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/cs-CZ-LNVE3QM5.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/de-CH-GCXOD4LK.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/de-DE-CGDBECYD.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/el-GR-G5QZC24A.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/es-ES-UMEOH76W.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/fa-IR-QOYVIIJA.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/fi-FI-BXRW65OA.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/fr-FR-R2QH5VCW.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/gl-ES-4ES3ZADP.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/he-IL-TRQRRYPH.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/hi-IN-U46BOJEC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/hu-HU-JDULJ6XL.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ja-JP-6HYAQFYX.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/kaa-Z5UP62XJ.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/kab-KAB-Z7STWQKS.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/kk-KZ-BWHY45DX.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/km-KH-HGLNWNRU.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ko-KR-CO36WKPC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ku-TR-AACVIARC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/lt-LT-CFYYFLDV.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/lv-LV-QCBBOFFU.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/mr-IN-B2CM5GK5.jshigh encoded/escaped-token density12
Show all 217 findings (low-signal and informational)

Showing 60 of 217 findings.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/prod/index.jsmatched "raw.githubusercontent.com"12
mediumObfuscation Densitypackage/dist/prod/index.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ar-SA-U3PIVEZH.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/az-AZ-COAM4HVM.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/bg-BG-D6B2W7JL.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/bn-BD-BU7GZAZW.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/bn-IN-MYKDEVNA.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ca-ES-GEEW5L7T.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/cs-CZ-LNVE3QM5.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/de-CH-GCXOD4LK.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/de-DE-CGDBECYD.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/el-GR-G5QZC24A.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/es-ES-UMEOH76W.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/fa-IR-QOYVIIJA.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/fi-FI-BXRW65OA.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/fr-FR-R2QH5VCW.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/gl-ES-4ES3ZADP.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/he-IL-TRQRRYPH.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/hi-IN-U46BOJEC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/hu-HU-JDULJ6XL.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ja-JP-6HYAQFYX.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/kaa-Z5UP62XJ.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/kab-KAB-Z7STWQKS.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/kk-KZ-BWHY45DX.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/km-KH-HGLNWNRU.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ko-KR-CO36WKPC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ku-TR-AACVIARC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/lt-LT-CFYYFLDV.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/lv-LV-QCBBOFFU.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/mr-IN-B2CM5GK5.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/my-MM-756BNN36.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/nb-NO-5BLHQI4J.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/nn-NO-4J7MR6GH.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/oc-FR-XCETH7KF.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/pa-IN-32NBAN5L.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/pl-PL-R6OJ54BT.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/pt-BR-7AFGAKGR.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/pt-PT-S6BMW6MY.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ro-RO-4JVGQHS2.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ru-RU-IESI752T.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/si-LK-H75E7PKD.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/sk-SK-EUK2NR2F.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/sl-SI-AKW7R5PW.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/sv-SE-QIBOOXLJ.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/ta-IN-LBK2NQ5K.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/th-TH-YJ2E6GVT.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/tr-TR-Y5GO2XJW.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/uk-UA-XYAFHHJW.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/vi-VN-WDPZEUOJ.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/zh-CN-SZ37453H.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/zh-HK-QDQ5QNBC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/dev/locales/zh-TW-CYU6GFBV.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/prod/locales/ar-SA-TS6M4GHP.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/prod/locales/az-AZ-HJWG4CPD.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/prod/locales/bg-BG-K42QREUV.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/prod/locales/bn-BD-IFEECH4W.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/prod/locales/bn-IN-OE7SKNFR.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/prod/locales/ca-ES-MKBCGNOG.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/prod/locales/cs-CZ-V77HGUP7.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/prod/locales/de-CH-WLRDEVBV.jshigh encoded/escaped-token density12

Manifest

Package metadata

Scripts4
  • build:esmrimraf dist && node ../../scripts/buildPackage.js && yarn gen:types
  • clearDistrimraf dist
  • gen:typesrimraf types && tsc
  • releaseyarn build:esm && yarn publish
Dependencies31
  • @braintree/sanitize-url6.0.2
  • @excalidraw/commonnpm:@myoc/[email protected]
  • @excalidraw/elementnpm:@myoc/[email protected]
  • @excalidraw/laser-pointer1.3.1
  • @excalidraw/mathnpm:@myoc/[email protected]
  • @excalidraw/random-username1.1.0
  • @lezer/highlight^1.0.0
  • browser-fs-access0.38.0
  • canvas-roundrect-polyfill0.0.1
  • clsx1.1.1
  • cross-env7.0.3
  • es6-promise-pool2.5.0
  • fuzzy0.1.3
  • image-blob-reduce3.0.1
  • jotai2.11.0
  • jotai-scope0.7.2
  • lodash.debounce4.0.8
  • lodash.throttle4.1.1
  • nanoid3.3.3
  • pako2.0.3
  • perfect-freehand1.2.0
  • pica7.1.1
  • png-chunk-text1.0.0
  • png-chunks-encode1.0.0
  • png-chunks-extract1.0.0
  • points-on-curve1.0.1
  • pwacompat2.0.17
  • radix-ui1.4.3
  • roughjs4.6.4
  • sass1.51.0
  • …and 1 more.