Package evidence

@pmate/[email protected]

Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,677Niche · −30% score
Versions published: 149
First published: Dec 2025
Publisher: ramroll

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@pmate/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@pmate/[email protected]"],"fail_on":"review"}'

Publisherramroll

Artifact bytes158,728

Previous version0.24.26

Published2026-05-29T02:32:11.982Z

SHA-256824823b85d1fda86e12d52ba31b2b8e572351362ae40fe67b8f56b41f7a46ba9

Why flagged

What the scanner saw

Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

15d agoLast checked

reviewRisk

31Score

0.24.27Version

Status history (1 event)

new → available15d ago · risk review · score 31 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Js Decode Then Exec	package/dist/index.js	base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.	45

Manifest

Package metadata

Scripts8

buildnpm run clean && tsup --config tsup.config.ts && node scripts/copy-templates.js
cleanrimraf dist
devts-node src/index.ts
preparenpm run build
releasenpm publish
startnode dist/index.js
testvitest run src/tests
typechecktsc --noEmit

Dependencies20

@alicloud/alidns20150109^4.0.0
@alicloud/cdn20180510^8.0.0
@alicloud/fc20230330^4.7.4
@alicloud/openapi-client^0.4.15
@alicloud/sts20150401^1.2.0
@linear/sdk^70.0.0
@pmate/chat-sdk^0.1.10
@types/ali-oss^6.16.13
ajv^8.17.1
ali-oss^6.23.0
chalk^4.1.2
dotenv^16.6.1
jsqr^1.4.0
openai^6.16.0
playwright^1.58.2
png-to-ico^3.0.1
pngjs^7.0.0
sharp^0.34.5
tslib^2.8.1
yaml^2.8.2