Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Known Indicator Filename: package/dist/lib/bundle.js
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 267 · status changed
Related candidates
Linked campaigns and clusters
Known Indicator Filename — package/dist/lib/bundle.js
3 members · evidence strength 80liuneng1994
3 members · evidence strength 74Evidence
Static findings
48 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/dist/lib/bundle.js | package/dist/lib/bundle.js | 45 |
| high | Credential file access | package/dist-bundle/web/assets/ssh-config-_ykCGR6B.js | matched ".ssh" | 30 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/blade-2xfisSek.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/chunk-727SXJPM-Da93duIk.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/flowDiagram-I6XJVG4X-DCh6PLpm.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/index-DwYi4kYg.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/julia-D7OTSIA_.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/php-Csjmro_R.js | high encoded/escaped-token density | 12 |
Show all 48 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/dist/lib/bundle.js | package/dist/lib/bundle.js | 45 |
| high | Credential file access | package/dist-bundle/web/assets/ssh-config-_ykCGR6B.js | matched ".ssh" | 30 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/blade-2xfisSek.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/chunk-727SXJPM-Da93duIk.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/flowDiagram-I6XJVG4X-DCh6PLpm.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/index-DwYi4kYg.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/julia-D7OTSIA_.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/php-Csjmro_R.js | high encoded/escaped-token density | 12 |
| low | Obfuscation | package/dist-bundle/web/assets/ara-BRHolxvo.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/blade-2xfisSek.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/blockDiagram-GPEHLZMM-Dm2RDf9l.js | matched "\\u000D" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/c4Diagram-AAUBKEIU-B5QnflKP.js | matched "eVal(" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/chunk-727SXJPM-Da93duIk.js | matched "\\u00AA" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/coffee-Ch7k5sss.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/crystal-DGywbUpC.js | matched "\\x08" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/css-CLj8gQPS.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/cytoscape.esm-BHYC38rz.js | matched "\\u200b" | 3 |
| low | Obfuscation | package/dist/commands/doctor.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/erDiagram-TEJ5UH35-Dh_YZA-A.js | matched "\\u00C0" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/flowDiagram-I6XJVG4X-DCh6PLpm.js | matched "\\u00AA" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/glimmer-js-ByusRIyA.js | matched "\\x08" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/glimmer-ts-BfAWNZQY.js | matched "\\x08" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/hack-DbPARsA_.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/html-pp8916En.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/index-DP8XTsB_.js | matched "\\u2028" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/index-DwYi4kYg.js | matched "\\u00C0" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/journeyDiagram-JHISSGLW-BgmnQsv8.js | matched "eVal(" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/julia-D7OTSIA_.js | matched "\\x01" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/katex-BTI-AXqd.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/katex-C5jXJg4s.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/less-B1dDrJ26.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/mermaid.core-haOdgLLT.js | matched "\\x1B" | 3 |
| low | Obfuscation | package/dist-bundle/server/extensions/parse-plugins.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist-bundle/server/extensions/parse-skills.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/php-Csjmro_R.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/puppet-BMWR74SV.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/quadrantDiagram-W4KKPZXB-CnuK6puC.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/ruby-DyJCeAvU.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/sankeyDiagram-5OEKKPKP-CwjvVVgO.js | matched "\\u000D" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/scss-D5BDwBP9.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/sequenceDiagram-3UESZ5HK-CUR7E-LX.js | matched "eVal(" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/stata-DI20mbqo.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/stylus-BEDo0Tqx.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/twig-CW1WmMYd.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/typst-DHCkPAjA.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/vue-D2xRrEX4.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/wardley-L42UT6IY-05OeGjXS.js | matched "\\u2028" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/wasm-CG6Dc4jp.js | matched "atob(" | 3 |
Manifest
Package metadata
Scripts3
buildtsc && node ../../scripts/build-cli-bundle.mjsprepublishOnlypnpm buildtypechecktsc --noEmit
Dependencies7
@agentclientprotocol/sdk^0.22.1@fastify/static^8.0.4@fastify/websocket^11.0.2better-sqlite3^12.10.0chokidar^5.0.0fastify^5.1.0open^10.1.0