Package evidence

@solidnumber/[email protected]

Obfuscation: matched "\\x1b"

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@solidnumber/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@solidnumber/[email protected]"],"fail_on":"review"}'

Publisheradamcampbell825

Artifact bytes740,365

Previous version2.11.3

Published2026-05-25T05:10:14.857Z

SHA-256a829e795c45a6b47690026ffe71c63354d36c87a94efb38efe4d0f72cb03cb5c

Why flagged

What the scanner saw

Obfuscation: matched "\\x1b"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

11d agoLast checked

reviewRisk

24Score

2.11.4Version

Status history (1 event)

new → available11d ago · risk review · score 24 · status changed

Evidence

Static findings

8 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 8 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Obfuscation	package/dist/lib/api-client.js	matched "\\x1b"	3
low	Obfuscation	package/dist/commands/diff.js	matched "\\u2026"	3
low	Obfuscation	package/dist/lib/graph-watch-render.js	matched "\\x1b"	3
low	Obfuscation	package/dist/commands/import.js	matched "\\u201c"	3
low	Obfuscation	package/dist/commands/serve.js	matched "\\u2713"	3
low	Obfuscation	package/dist/lib/tui.js	matched "\\x1b"	3
low	Obfuscation	package/dist/lib/ui.js	matched "\\x1b"	3
low	Obfuscation	package/dist/commands/watch.js	matched "\\u25CF"	3

Manifest

Package metadata

Scripts17

auditnpm audit --audit-level=high
audit:prodnpm audit --omit=dev --audit-level=high
buildtsc && node -e "require('fs').cpSync('src/data','dist/data',{recursive:true})"
devts-node src/index.ts
linteslint src/**/*.ts
postbuildts-node scripts/generate-llms.ts
prepublish:checkbash scripts/prepublish.sh
prepublishOnlynpm run build && npm test && npm run test:security && npm run audit:prod && npm run verify:deps
startnode dist/index.js
testjest --forceExit --detectOpenHandles
test:coveragejest --coverage --forceExit --detectOpenHandles
test:securityjest --testPathPattern=company-isolation --forceExit
test:smokejest --testPathPattern=integration --forceExit
test:tarballbash scripts/test-tarball.sh
verify:depsnode scripts/verify-runtime-deps.mjs
verify:llmsts-node scripts/generate-llms.ts --check
verify:schemasts-node scripts/verify-schemas.ts

Dependencies15

@puppeteer/browsers^2.13.0
axios^1.6.0
boxen^8.0.1
chalk^4.1.2
cli-progress^3.12.0
commander^12.0.0
figures^6.1.0
form-data^4.0.5
gradient-string^3.0.0
inquirer^9.2.0
jsonld^9.0.0
lighthouse^13.1.0
ora^8.0.0
puppeteer-core^24.42.0
update-notifier^7.3.1

Optional dependencies1

@anthropic-ai/sdk^0.39.0