Package evidence

@zeniai/[email protected]

Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 19,864Mainstream · −50% score
Versions published: 10,650Mature · −50% score
First published: Oct 2020
Publisher: nikunj1729

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@zeniai/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@zeniai/[email protected]"],"fail_on":"review"}'

Publishernikunj1729

Artifact bytes5,000,449

Previous version5.1.63-qa

Published2026-05-29T10:20:17.882Z

SHA-2562d04af8972e69d4ddafc5e41c768d44398e6ef4cf4a8c93793046f19d9cdb83c

Why flagged

What the scanner saw

Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

15d agoLast checked

reviewRisk

25Score

5.1.64-devVersion

Status history (1 event)

new → available15d ago · risk review · score 25 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Js Decode Then Exec	package/dist/assets/pdf-CojJ326Z.js	base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.	45
high	Js Split Join Obfuscation	package/dist/assets/lottie-Byecfo2L.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Js Decode Then Exec	package/dist/assets/pdf-CojJ326Z.js	base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.	45
high	Js Split Join Obfuscation	package/dist/assets/lottie-Byecfo2L.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40
low	Large Javascript Payload	package/dist/assets/index-ChP5wU0r.js	9163813 bytes	0
low	Large Javascript Payload	package/dist/assets/zeni-epic-state-D_HFZhXl.js	2930566 bytes	0

Manifest

Package metadata

Scripts59

//When publishing to NPM, use the version suffix -dev for DEV, -qa for QA, -next for NEXT and -prod version suffix for PROD.
analyzeANALYZE=true NODE_OPTIONS=--max-old-space-size=16384 vite build --mode development
buildpnpm lint-modified-files && pnpm tsc-modified-files && NODE_OPTIONS=--max-old-space-size=16384 vite build --mode development
build-scriptspnpm run check-version && tsc --outDir scripts --target ES6 --module commonjs --esModuleInterop --skipLibCheck
build_delhitsc && NODE_OPTIONS=--max-old-space-size=16384 vite build --mode delhi
build_devtsc && NODE_OPTIONS=--max-old-space-size=16384 vite build --mode development
build_mohalitsc && NODE_OPTIONS=--max-old-space-size=16384 vite build --mode mohali
build_nexttsc && NODE_OPTIONS=--max-old-space-size=16384 vite build --mode next
build_prodtsc && NODE_OPTIONS=--max-old-space-size=16384 vite build --mode production
build_punetsc && NODE_OPTIONS=--max-old-space-size=16384 vite build --mode pune
build_qatsc && NODE_OPTIONS=--max-old-space-size=16384 vite build --mode qa
build_sunnyvaletsc && NODE_OPTIONS=--max-old-space-size=16384 vite build --mode sunnyvale
check-dependenciesnode ./scripts/check_dependencies.js
check-versionnode ./scripts/check_version.js
clean-overridesnode ./scripts/clean_overrides.js
copy-service-workercp public/service-worker.js dist/service-worker.js && cp public/service-worker-helpers.js dist/service-worker-helpers.js
formatprettier --write --ignore-unknown "src/**/*" && pnpm lint
format-stagedgit diff --cached --name-only --diff-filter=ACM | grep -E '\.(ts|tsx|js)$' | xargs prettier --write || true
format-watch(git diff --name-only --diff-filter=ACM && git ls-files --others --exclude-standard) | grep -E '\.(ts|tsx|js)$' | xargs prettier --write || true
linteslint . --ext .js,.jsx,.ts,.tsx --fix
lint-modified-fileschmod +x ./scripts/lint-modified-files.sh && ./scripts/lint-modified-files.sh
lint:fix-modified-fileschmod +x ./scripts/lint-modified-files.sh && LINT_FIX=true ./scripts/lint-modified-files.sh
postversiongit push && git push --tags
previewvite preview --mode development --host
preview_delhivite preview --mode delhi --host
preview_devvite preview --mode development --host
preview_mohalivite preview --mode mohali --host
preview_nextvite preview --mode next --host
preview_prodvite preview --mode production --host
preview_punevite preview --mode pune --host
…and 29 more.

Dependencies56

@babel/core^7.16.5
@babel/runtime^7.26.10
@emotion/cache^11.13.1
@emotion/react11.10.0
@emotion/styled11.10.0
@fingerprintjs/fingerprintjs^5.0.1
@lexical/code^0.9.1
@lexical/html^0.9.1
@lexical/link^0.9.1
@lexical/list^0.9.1
@lexical/markdown^0.9.1
@lexical/react^0.9.1
@lexical/rich-text^0.9.1
@lexical/selection^0.9.1
@lexical/table^0.9.1
@lexical/utils^0.9.1
@liveblocks/react^2.23.0
@liveblocks/react-ui^2.23.0
@mui/material^7.3.5
@sentry/core^9.42.1
@sentry/react^9.42.1
@stripe/stripe-js^4.4.0
@zeniai/client-analytics2.0.24
@zeniai/client-epic-state5.1.7
@zeniai/web-components4.1.84
color3.1.3
cross-fetch^4.0.0
crypto-js4.2.0
dnd-core^16.0.1
history^5.2.0
…and 26 more.