Package evidence

@regulaforensics/[email protected]

Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 2,359Niche · −30% score
Versions published: 902Mature · −50% score
First published: Feb 2024
Publisher: regula

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@regulaforensics/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@regulaforensics/[email protected]"],"fail_on":"review"}'

Publisherregula

Artifact bytes1,981,765

Previous version9.5.997-rc

Published2026-05-29T10:43:20.273Z

SHA-2566e3ba0bded30d945a7f0532f68d700866e1fe5fed49e3b1779ac65014c925761

Why flagged

What the scanner saw

Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

18d agoLast checked

reviewRisk

25Score

9.5.998Version

Status history (1 event)

new → available18d ago · risk review · score 25 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Js Decode Then Exec	package/dist/core/index.cjs	base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.	45
high	Js Decode Then Exec	package/dist/main/index.cjs	base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.	45
high	Js Decode Then Exec	package/dist/typings/index.cjs	base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.	45
high	Js Decode Then Exec	package/dist/typings/index.js	base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.	45

Manifest

Package metadata

Scripts15

buildnpm run check-types && npm run build:main && npm run build:core && npm run build:typings
build-storybookstorybook build
build:corevite build --config vite-build-core.config.ts && npm run extract:core
build:mainvite build --config vite-build.config.ts && npm run extract:main
build:typingsvite build --config vite-build-typings.config.ts && npm run extract:typings
check-typestsc --noEmit --skipLibCheck
docstypedoc --out docs src/document-reader/typings
extract:coreapi-extractor run --local --verbose --config api-extractor.core.json && rimraf dist/core/types
extract:mainapi-extractor run --local --verbose --config api-extractor.main.json && rimraf dist/main/types
extract:typingsapi-extractor run --local --verbose --config api-extractor.typings.json && rimraf dist/typings/types
i18n:buildnpx node scripts/i18n/i18n-build.js --file ./scripts/i18n/Translator.xml --src ./src
i18n:reportnpx node scripts/i18n/i18n-report.js --file ./scripts/i18n/Translator.xml --src ./src
preparehusky
storybookstorybook dev -p 6006
testvitest run

Dependencies18

@regulaforensics/document-reader-webclient^9.5.895-rc
@regulaforensics/facesdk-webclient^8.2.524-nightly
@uiw/react-json-view^2.0.0-alpha.41
class-transformer^0.5.1
class-validator^0.14.3
classnames^2.5.1
date-fns^4.1.0
i18next^25.8.13
lodash^4.17.23
overlayscrollbars^2.14.0
overlayscrollbars-react^0.5.6
pako^2.1.0
react-device-detect^2.2.3
react-i18next^16.5.4
react-scroll^1.9.3
react-transition-group^4.4.5
reflect-metadata^0.2.2
thenby^1.3.4