Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Publisher
- GitHub ActionsTrusted automation · −70% score
Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@xpert-ai/[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@xpert-ai/[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Obfuscation Density: high encoded/escaped-token density
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 202 · status changed
Evidence
Static findings
53 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/dist/index.cjs | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/app/assets/chunk-4TB4RGXK-CKtq_VWl.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/app/assets/flowDiagram-DWJPFMVM-CEJD5iZj.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/index.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/dist/app/assets/index-0WK7GO0-.js | 2797896 bytes | 10 |
Show all 53 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/dist/index.cjs | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/app/assets/chunk-4TB4RGXK-CKtq_VWl.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/app/assets/flowDiagram-DWJPFMVM-CEJD5iZj.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/index.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/dist/app/assets/index-0WK7GO0-.js | 2797896 bytes | 10 |
| low | Obfuscation | package/dist/index.cjs | matched "\\u2022" | 3 |
| low | Obfuscation | package/dist/app/assets/blockDiagram-DXYQGD6D-BxQggcio.js | matched "\\u000D" | 3 |
| low | Obfuscation | package/dist/app/assets/bsl-bByDNkfu.js | matched "\\u0400" | 3 |
| low | Obfuscation | package/dist/app/assets/c4Diagram-AHTNJAMY-CwJ8mP6o.js | matched "eVal(" | 3 |
| low | Obfuscation | package/dist/app/assets/cfscript-Bgsey_t-.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/chunk-4TB4RGXK-CKtq_VWl.js | matched "\\u00AA" | 3 |
| low | Obfuscation | package/dist/app/assets/core-DLrIFmIQ.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/app/assets/css-CF9HHZb0.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/css-extras-JR2GXaTG.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/cytoscape.esm-DkOyvmE4.js | matched "\\u200b" | 3 |
| low | Obfuscation | package/dist/app/assets/dax-DgehXfC1.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/dhall-B-8B_ccq.js | matched "\\u2200" | 3 |
| low | Obfuscation | package/dist/app/assets/dot-DawGiMaK.js | matched "\\x80" | 3 |
| low | Obfuscation | package/dist/app/assets/erDiagram-SMLLAGMA-CO-YY4RS.js | matched "\\u00C0" | 3 |
| low | Obfuscation | package/dist/app/assets/firestore-security-rules-DTC3Hd2Z.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/flow-Cy9gswVq.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/flowDiagram-DWJPFMVM-CEJD5iZj.js | matched "\\u00AA" | 3 |
| low | Obfuscation | package/dist/app/assets/gedcom-Ctm1PKdU.js | matched "\\x80" | 3 |
| low | Obfuscation | package/dist/app/assets/icu-message-format-6GheGdTN.js | matched "\\u221e" | 3 |
| low | Obfuscation | package/dist/index.js | matched "\\u2022" | 3 |
| low | Obfuscation | package/dist/app/assets/javascript-D8vYUPHd.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/jexl-kq_Kr8N1.js | matched "\\u00C0" | 3 |
| low | Obfuscation | package/dist/app/assets/journeyDiagram-VCZTEJTY-cH7y7LfB.js | matched "eVal(" | 3 |
| low | Obfuscation | package/dist/app/assets/js-extras-GrY_q6jW.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/jsdoc-DBwDG9t_.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/json5-Bjv9HTdW.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/jsonp-D5aVdmyI.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/jsstacktrace-MmLxBswX.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/kumir-B5qtRLO8.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist/app/assets/markdown-CyFQtnhr.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/app/assets/mongodb-DM4nXhmT.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/nginx-CpUZp5AB.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist/app/assets/pure-CCySSQgh.js | matched "eval(" | 3 |
| low | Obfuscation | package/dist/app/assets/purescript-DQmYwfWM.js | matched "\\xa2" | 3 |
| low | Obfuscation | package/dist/app/assets/qml-Bav4ShVA.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/dist/app/assets/ruby-DYsn9XfW.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist/app/assets/sankeyDiagram-XADWPNL6-D0rDQxH3.js | matched "\\u000D" | 3 |
| low | Obfuscation | package/dist/app/assets/sas-HpwRSma8.js | matched "eval(" | 3 |
| low | Obfuscation | package/dist/app/assets/scheme-Cscf027c.js | matched "\\uD800" | 3 |
| low | Obfuscation | package/dist/app/assets/sequenceDiagram-FGHM5R23-CvZ2gxFN.js | matched "eVal(" | 3 |
| low | Obfuscation | package/dist/app/assets/shell-session-Dlpy3KwM.js | matched "\\x1F" | 3 |
| low | Obfuscation | package/dist/app/assets/stan-X6TSWZ3J.js | matched "\\x20" | 3 |
| low | Obfuscation | package/dist/app/assets/turtle-Ro1R6Je7.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist/app/assets/wardley-RL74JXVD-BygmHcr8.js | matched "\\u2028" | 3 |
| low | Obfuscation | package/dist/app/assets/wren-RYBcpwe2.js | matched "\\u3000" | 3 |
| low | Obfuscation | package/dist/app/assets/yaml-pHjxJgpq.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist/app/assets/zig-DMcJdVmM.js | matched "\\uD800" | 3 |
| low | Obfuscation | package/dist/app/pets/miso/pet.json | matched "\\u2019" | 3 |
Manifest
Package metadata
Scripts8
buildpnpm run build:lib && pnpm run build:appbuild:appvite buildbuild:libtsup src/index.ts --format esm,cjs --dts --cleancleanrimraf distdevvitelinteslint .testvitest run --passWithNoTeststypestsc
Dependencies38
@fontsource-variable/geist^5.2.8@fontsource-variable/inter^5.2.8@langchain/core^1.0.2@radix-ui/react-avatar^1.1.11@radix-ui/react-dialog^1.1.4@radix-ui/react-popover^1.1.4@radix-ui/react-scroll-area^1.2.10@radix-ui/react-separator^1.1.2@radix-ui/react-slot^1.1.2@radix-ui/react-tooltip^1.1.20@tailwindcss/vite^4.1.17@xpert-ai/a2ui-react~0.1.0@xpert-ai/chatkit-types~0.3.9@xpert-ai/chatkit-web-shared~0.3.3@xpert-ai/xpert-sdk^0.0.11class-variance-authority^0.7.1clsx^2.1.1framer-motion^12.4.9i18next^23.16.8katex^0.16.21lodash-es^4.17.21lucide-react^0.562.0mermaid^11.12.0nuqs^2.4.1radix-ui^1.4.3react-i18next^15.4.0react-markdown^10.0.1react-syntax-highlighter^15.5.0rehype-katex^7.0.1remark-gfm^4.0.1- …and 8 more.