PkgRadar

Package evidence

[email protected]

Obfuscation: matched "\\u2028"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
107,199,932Ubiquitous · −70% score
Versions published
288Mature · −50% score
First published
Dec 2010
Publisher
wesleytodd

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherwesleytodd
Artifact bytes56,134
Previous version4.19.1
Published2024-03-25T14:30:36.103Z
SHA-2561b18c90e7e9fc4cb3e4dfe6b5f11c21b85509162e88ca5c6b63b9c6b5ca085bf

Why flagged

What the scanner saw

Obfuscation: matched "\\u2028"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
4.19.2Version
Status history (1 event)
  1. new → available · risk low · score 0 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 1 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowObfuscationpackage/lib/response.jsmatched "\\u2028"3

Manifest

Package metadata

Scripts5
  • linteslint .
  • testmocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/
  • test-cinyc --reporter=lcovonly --reporter=text npm test
  • test-covnyc --reporter=html --reporter=text npm test
  • test-tapmocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/
Dependencies31
  • accepts~1.3.8
  • array-flatten1.1.1
  • body-parser1.20.2
  • content-disposition0.5.4
  • content-type~1.0.4
  • cookie0.6.0
  • cookie-signature1.0.6
  • debug2.6.9
  • depd2.0.0
  • encodeurl~1.0.2
  • escape-html~1.0.3
  • etag~1.8.1
  • finalhandler1.2.0
  • fresh0.5.2
  • http-errors2.0.0
  • merge-descriptors1.0.1
  • methods~1.1.2
  • on-finished2.4.1
  • parseurl~1.3.3
  • path-to-regexp0.1.7
  • proxy-addr~2.0.7
  • qs6.11.0
  • range-parser~1.2.1
  • safe-buffer5.2.1
  • send0.18.0
  • serve-static1.15.0
  • setprototypeof1.2.0
  • statuses2.0.1
  • type-is~1.6.18
  • utils-merge1.0.1
  • …and 1 more.