Package evidence

@selfxyz/[email protected]

Remote Dependency Spec: dependencies.node-forge="github:remicolin/forge#17a11a632dd0e50343b3b8393245a2696f78afbb"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 934
Versions published: 9
First published: Jun 2025
Publisher: nicoshark

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@selfxyz/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@selfxyz/[email protected]"],"fail_on":"review"}'

Publishernicoshark

Artifact bytes39,913,507

Previous version0.0.8

Published2025-09-22T04:42:43.211Z

SHA-2569cce460a6f422a636277abeec79d4bca83e95574b4e9bc7714b0c443eea162ce

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.node-forge="github:remicolin/forge#17a11a632dd0e50343b3b8393245a2696f78afbb"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

11d agoLast checked

reviewRisk

12Score

0.0.9Version

Status history (1 event)

new → available11d ago · risk review · score 12 · status changed

Evidence

Static findings

27 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	dependencies.node-forge="github:remicolin/forge#17a11a632dd0e50343b3b8393245a2696f78afbb"	12

Show all 27 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Dependency Spec	package.json	dependencies.node-forge="github:remicolin/forge#17a11a632dd0e50343b3b8393245a2696f78afbb"	12
low	Obfuscation Density	package/dist/cjs/index.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/constants/skiPem.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/utils/csca.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/utils/index.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/utils/passports/core.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/utils/passports/genMockIdDoc.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/utils/passports/genMockPassportData.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/utils/passports/index.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/utils/passports/mock.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/utils/passports/mockGeneration.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/utils/passports/passport.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/utils/passports/passport_parsing/parseDscCertificateData.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/cjs/src/utils/trees.cjs	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/index.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/constants/skiPem.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/utils/csca.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/utils/index.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/utils/passports/core.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/utils/passports/genMockIdDoc.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/utils/passports/genMockPassportData.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/utils/passports/index.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/utils/passports/mock.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/utils/passports/mockGeneration.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/utils/passports/passport.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/utils/passports/passport_parsing/parseDscCertificateData.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/esm/src/utils/trees.js	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts17

buildtsup && yarn build:types && yarn postbuild
build:typestsc -p tsconfig.json --emitDeclarationOnly && tsc -p tsconfig.cjs.json --emitDeclarationOnly
build:watchtsup --watch
formatprettier --write .
lintprettier --check .
lint:importsyarn eslint --fix .
lint:imports:checkyarn eslint .
niceyarn format && yarn lint:imports
nice:checkyarn lint && yarn lint:imports:check
postbuildnode ./scripts/postBuild.mjs
prepublishOnlyyarn build
testvitest run
test:exportsnode scripts/validateExports.js && node scripts/testExports.js
test:scopevitest run tests/scope.test.ts
test:uivitest --ui
test:watchvitest
typestsc -p tsconfig.json

Dependencies29

@anon-aadhaar/corenpm:@selfxyz/anon-aadhaar-core@^0.0.1
@openpassport/zk-kit-imt^0.0.5
@openpassport/zk-kit-lean-imt^0.0.6
@openpassport/zk-kit-smt^0.0.1
@peculiar/x509^1.12.3
@stablelib/cbor^2.0.1
asn1.js^5.4.1
asn1js^3.0.5
axios^1.7.2
buffer^6.0.3
country-emoji^1.5.6
country-iso-3-to-2^1.1.1
elliptic^6.5.5
ethers^6.14.4
fs^0.0.1-security
hash.js^1.1.7
i18n-iso-countries^7.13.0
js-sha1^0.7.0
js-sha256^0.11.0
js-sha512^0.9.0
json-to-ts^2.1.0
jsrsasign^11.1.0
node-forgegithub:remicolin/forge#17a11a632dd0e50343b3b8393245a2696f78afbb
path^0.12.7
pkijs^3.2.4
poseidon-lite^0.2.0
snarkjs^0.7.5
typescript-parser^2.6.1
uuid^11.1.0