PkgRadar

Package evidence

@shohojdhara/[email protected]

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
120
Versions published
79Mature · −50% score
First published
Jun 2025
Publisher
liimonx

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@shohojdhara/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@shohojdhara/[email protected]"],"fail_on":"review"}'
Publisherliimonx
Artifact bytes4,547,639
Previous version0.6.5
Published2026-06-03T16:22:00.030Z
SHA-2565484dd804a346078be3d1b1386921be57214d22dcb2d8ad5d61e10a9214e5cac

Why flagged

What the scanner saw

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
35Score
0.6.6Version
Status history (1 event)
  1. new → available · risk review · score 35 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highJs Split Join Obfuscationpackage/dist/index.esm.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
highJs Split Join Obfuscationpackage/dist/index.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
highJs Split Join Obfuscationpackage/src/lib/config/loader.tsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
highJs Split Join Obfuscationpackage/src/lib/theme/config/loader.tsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40

Manifest

Package metadata

Scripts35
  • attwattw --pack
  • buildnpm run prebuild && npm run build:parallel && npm run postbuild
  • build:analyzeANALYZE=true rollup -c
  • build:clirollup -c rollup/entries/cli.js
  • build:cli:devrollup -c rollup/entries/cli.js --environment NODE_ENV:development
  • build:jsrollup -c rollup/entries/build.js
  • build:parallelconcurrently "npm:build:js" "npm:build:types" "npm:build:styles" "npm:build:umd"
  • build:sequentialrollup -c
  • build:storybookstorybook build
  • build:stylesrollup -c rollup/entries/styles.js
  • build:themesrollup -c rollup/config/themes.js
  • build:typesrollup -c rollup/entries/types.js
  • build:umdrollup -c rollup/entries/umd.js
  • changesetchangeset
  • cleanrimraf dist
  • clean:allrimraf dist && rimraf .storybook/dist && rimraf storybook-static
  • devstorybook dev -p 6006
  • linteslint src
  • lint:fixeslint src --fix
  • postbuildmkdir -p dist/build-tools && cp -r build-tools/* dist/build-tools/
  • prebuildnpm run validate:config
  • prebuild:with-tokensnpm run sync:tokens && npm run validate:config
  • prepackecho 'Preparing package for publishing...'
  • prepublishOnlynpm run clean && npm run build && npm run attw
  • prettierprettier --write 'src/**/*.{ts,tsx,js,jsx,json,css,scss}'
  • releasechangeset publish
  • sync:tokensnpx tsx scripts/generate-tokens.ts
  • testvitest
  • test:buildnode scripts/test-build.js
  • test:clivitest run --config vitest.config.cli.js scripts/cli/__tests__
  • …and 5 more.
Dependencies11
  • autoprefixer^10.4.21
  • boxen^7.1.0
  • chalk^5.3.0
  • chokidar^3.5.3
  • commander^11.0.0
  • cssnano^6.0.0
  • inquirer^9.2.0
  • ora^6.3.0
  • postcss^8.4.31
  • sass^1.69.0
  • ts-node^10.9.0