PkgRadar

Package evidence

@selfxyz/[email protected]

Remote Dependency Spec: dependencies.@anon-aadhaar/core="https://gitpkg.vercel.app/selfxyz/anon-aadhaar/packages/core?1b9efa501cff3cf25dc260b060bf611229e316a4"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,289Niche · −30% score
Versions published
9
First published
Jun 2025
Publisher
nicoshark

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@selfxyz/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@selfxyz/[email protected]"],"fail_on":"high"}'
Publishernicoshark
Artifact bytes39,293,493
Previous version0.0.7
Published2025-09-18T10:36:57.704Z
SHA-2568a8a18ad6ee5c9f8165e38263560cfd85c7176f8916bd584c73580d1e39e0725

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.@anon-aadhaar/core="https://gitpkg.vercel.app/selfxyz/anon-aadhaar/packages/core?1b9efa501cff3cf25dc260b060bf611229e316a4"

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
36Score
0.0.8Version
Status history (2 events)
  1. available → available · risk high · score 36 · status available -> available, risk high -> high, score 59 -> 36
  2. new → available · risk high · score 59 · status changed

Evidence

Static findings

28 static · 1 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highRemote Dependency Specpackage.jsondependencies.@anon-aadhaar/core="https://gitpkg.vercel.app/selfxyz/anon-aadhaar/packages/core?1b9efa501cff3cf25dc260b060bf611229e316a4"12
mediumRemote Dependency Specpackage.jsondependencies.node-forge="github:remicolin/forge#17a11a632dd0e50343b3b8393245a2696f78afbb"12
highNew Remote Dependency Vs Previouspackage.jsondependencies.@anon-aadhaar/core added in 0.0.8 vs 0.0.7: "https://gitpkg.vercel.app/selfxyz/anon-aadhaar/packages/core?1b9efa501cff3cf25dc260b060bf611229e316a4"12
Show all 29 findings (low-signal and informational)
SeverityKindPathDetailPoints
highRemote Dependency Specpackage.jsondependencies.@anon-aadhaar/core="https://gitpkg.vercel.app/selfxyz/anon-aadhaar/packages/core?1b9efa501cff3cf25dc260b060bf611229e316a4"12
mediumRemote Dependency Specpackage.jsondependencies.node-forge="github:remicolin/forge#17a11a632dd0e50343b3b8393245a2696f78afbb"12
highNew Remote Dependency Vs Previouspackage.jsondependencies.@anon-aadhaar/core added in 0.0.8 vs 0.0.7: "https://gitpkg.vercel.app/selfxyz/anon-aadhaar/packages/core?1b9efa501cff3cf25dc260b060bf611229e316a4"12
lowObfuscation Densitypackage/dist/cjs/index.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/constants/skiPem.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/utils/csca.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/utils/index.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/utils/passports/core.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/utils/passports/genMockIdDoc.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/utils/passports/genMockPassportData.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/utils/passports/index.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/utils/passports/mock.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/utils/passports/mockGeneration.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/utils/passports/passport.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/utils/passports/passport_parsing/parseDscCertificateData.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/cjs/src/utils/trees.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/index.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/constants/skiPem.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/utils/csca.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/utils/index.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/utils/passports/core.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/utils/passports/genMockIdDoc.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/utils/passports/genMockPassportData.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/utils/passports/index.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/utils/passports/mock.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/utils/passports/mockGeneration.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/utils/passports/passport.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/utils/passports/passport_parsing/parseDscCertificateData.jshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/esm/src/utils/trees.jshigh encoded/escaped-token density0

Remote payloads

Followed remote artifacts

SourceURLRiskScoreSummary
dependencies.@anon-aadhaar/corehttps://gitpkg.vercel.app/selfxyz/anon-aadhaar/packages/core?1b9efa501cff3cf25dc260b060bf611229e316a4error0HTTP status client error (402 Payment Required) for url (https://gitpkg.vercel.app/selfxyz/anon-aadhaar/packages/core?1b9efa501cff3cf25dc260b060bf611229e316a4)

Manifest

Package metadata

Scripts17
  • buildtsup && yarn build:types && yarn postbuild
  • build:typestsc -p tsconfig.json --emitDeclarationOnly && tsc -p tsconfig.cjs.json --emitDeclarationOnly
  • build:watchtsup --watch
  • formatprettier --write .
  • lintprettier --check .
  • lint:importsyarn eslint --fix .
  • lint:imports:checkyarn eslint .
  • niceyarn format && yarn lint:imports
  • nice:checkyarn lint && yarn lint:imports:check
  • postbuildnode ./scripts/postBuild.mjs
  • prepublishOnlyyarn build
  • testvitest run
  • test:exportsnode scripts/validateExports.js && node scripts/testExports.js
  • test:scopevitest run tests/scope.test.ts
  • test:uivitest --ui
  • test:watchvitest
  • typestsc -p tsconfig.json
Dependencies29
  • @anon-aadhaar/corehttps://gitpkg.vercel.app/selfxyz/anon-aadhaar/packages/core?1b9efa501cff3cf25dc260b060bf611229e316a4
  • @openpassport/zk-kit-imt^0.0.5
  • @openpassport/zk-kit-lean-imt^0.0.6
  • @openpassport/zk-kit-smt^0.0.1
  • @peculiar/x509^1.12.3
  • @stablelib/cbor^2.0.1
  • asn1.js^5.4.1
  • asn1js^3.0.5
  • axios^1.7.2
  • buffer^6.0.3
  • country-emoji^1.5.6
  • country-iso-3-to-2^1.1.1
  • elliptic^6.5.5
  • ethers^6.14.4
  • fs^0.0.1-security
  • hash.js^1.1.7
  • i18n-iso-countries^7.13.0
  • js-sha1^0.7.0
  • js-sha256^0.11.0
  • js-sha512^0.9.0
  • json-to-ts^2.1.0
  • jsrsasign^11.1.0
  • node-forgegithub:remicolin/forge#17a11a632dd0e50343b3b8393245a2696f78afbb
  • path^0.12.7
  • pkijs^3.2.4
  • poseidon-lite^0.2.0
  • snarkjs^0.7.5
  • typescript-parser^2.6.1
  • uuid^11.1.0