PkgRadar

Package evidence

@wowok/[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
531
Versions published
6
First published
May 2026
Publisher
wowok

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@wowok/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@wowok/[email protected]"],"fail_on":"review"}'
Publisherwowok
Artifact bytes449,065
Previous version2.2.15
Published2026-05-26T13:01:17.968Z
SHA-256805ebd4db15c5ef44971a000a2727a4f03e9ae86d43b234051bc052bbbcddbf2

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
50Score
2.2.16Version
Status history (1 event)
  1. new → available · risk review · score 50 · status changed

Evidence

Static findings

28 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/cjs/w/call/arbitration.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/call/arbitration.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/call/guard.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/call/guard.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/call/machine.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/call/machine.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/messenger/messenger-api.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/messenger/messenger-api.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/call/permission.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/call/permission.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/call/progress.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/call/progress.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/call/repository.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/call/repository.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/call/reward.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/call/reward.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/call/service.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/call/service.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/messenger/storage.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/messenger/storage.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/call/treasury.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/call/treasury.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/util.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/util.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/local/wip.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/local/wip.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/cjs/w/messenger/templates/wts-html-template.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/esm/w/messenger/templates/wts-html-template.jshigh encoded/escaped-token density12

Manifest

Package metadata

Scripts25
  • analyzesize-limit --why
  • buildtsc --project tsconfig.json && tsc --project tsconfig.esm.json && pnpm obfuscate
  • build:testtsc --project tsconfig.json && tsc --project tsconfig.esm.json
  • cleanrm -rf tsconfig.tsbuildinfo ./dist
  • codegenpnpm codegen:grpc && pnpm codegen:graphql && pnpm lint:fix
  • codegen:graphqlgraphql-codegen --config graphql-codegen.ts
  • codegen:grpcnode tooling/codegen-grpc.mjs
  • eslint:checkeslint --max-warnings=0 .
  • eslint:fixpnpm run eslint:check --fix
  • lintpnpm run eslint:check && pnpm run prettier:check
  • lint:fixpnpm run eslint:fix && pnpm run prettier:fix
  • obfuscatejavascript-obfuscator dist/cjs --output dist/cjs --config obfuscator.json && javascript-obfuscator dist/esm --output dist/esm --config obfuscator.json
  • prebuilds:downloadnode scripts/download-prebuilds.js
  • prettier:checkprettier -c --ignore-unknown .
  • prettier:fixprettier -w --ignore-unknown .
  • sizesize-limit
  • sync-graphql-schemanode tooling/sync-graphql-schema.mjs
  • sync-protosnode tooling/sync-protos.mjs
  • testpnpm test:typecheck && pnpm test:unit
  • test:e2evitest run --config test/e2e/vitest.config.mts
  • test:typechecktsc -p ./test
  • test:unitvitest run unit __tests__
  • verify-graphql-schemanode tooling/verify-graphql-schema.mjs
  • verify-protosnode tooling/verify-protos.mjs
  • vitestvitest
Dependencies14
  • @noble/curves=1.9.4
  • @noble/hashes^1.8.0
  • @noble/post-quantum^0.6.1
  • @protobuf-ts/grpcweb-transport^2.11.1
  • @protobuf-ts/runtime^2.11.1
  • @protobuf-ts/runtime-rpc^2.11.1
  • @scure/base^1.2.6
  • @scure/bip39^1.6.0
  • @types/lodash^4.17.21
  • @zip.js/zip.js^2.7.57
  • graphql^16.12.0
  • libsql^0.5.29
  • lodash^4.17.21
  • valibot^1.2.0