PkgRadar

Package evidence

[email protected]

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
22
First published
Feb 2026
Publisher
rust142

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherrust142
Artifact bytes342,523
Previous version0.9.0
Published2026-04-09T06:03:30.478Z
SHA-2566f1600375cf40fc444a2c81886f505f952ffd938c633922116025c94a2105aac

Why flagged

What the scanner saw

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
45Score
0.9.1Version
Status history (1 event)
  1. new → available · risk review · score 45 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highJs Split Join Obfuscationpackage/lib/workflows/reword.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
highJs Split Join Obfuscationpackage/lib/workflows/reword.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
lowCredential file accesspackage/lib/api/copilot-sdk.jsmatched "GITHUB_TOKEN"5

Manifest

Package metadata

Scripts43
  • buildtsc && chmod +x ./lib/index.js
  • check:fastbun run format:check && bun run lint && bun run lint:md && bun run lint:yaml && bun run lint:spell
  • check:fullbun run typecheck && bun run build
  • cleanrm -rf lib
  • commitlintcommitlint --edit
  • copilotgh
  • cspellcspell
  • cspell:checknode ./scripts/cspell-check.js
  • cspell:interactivenode ./scripts/cspell-ignore.js
  • danger:cidanger ci
  • danger:localdanger pr
  • devbun src/index.ts
  • formatprettier --write "src/**/*.{ts,json,md}"
  • format:checkprettier --check "src/**/*.{ts,json,md}"
  • geeto:buildbun build --compile --minify --sourcemap lib/index.js --outfile geeto
  • geeto:build:allbun run geeto:build:linux && bun run geeto:build:linux:arm64 && bun run geeto:build:windows && bun run geeto:build:mac && bun run geeto:build:mac:arm64
  • geeto:build:linuxbun build --compile --minify --target=bun-linux-x64 lib/index.js --outfile geeto-linux
  • geeto:build:linux:arm64bun build --compile --minify --target=bun-linux-arm64 lib/index.js --outfile geeto-linux-arm64
  • geeto:build:macbun build --compile --minify --target=bun-darwin-x64 lib/index.js --outfile geeto-mac
  • geeto:build:mac:arm64bun build --compile --minify --target=bun-darwin-arm64 lib/index.js --outfile geeto-mac-arm64
  • geeto:build:windowsbun build --compile --minify --target=bun-windows-x64 lib/index.js --outfile geeto-windows.exe
  • install:localbash scripts/install-local.sh
  • linteslint src --ext .ts
  • lint-stagedlint-staged
  • lint:fixeslint src --ext .ts --fix
  • lint:mdmarkdownlint "**/*.md" --ignore node_modules
  • lint:md:fixmarkdownlint "**/*.md" --ignore node_modules --fix
  • lint:spellcspell "**/*.{md,mdx,txt,ts,tsx,js,jsx,json}" --no-progress
  • lint:yamlyamllint "**/*.{yml,yaml}" --ignore node_modules
  • postpublishpinst --enable
  • …and 13 more.
Dependencies2
  • @google/genai^1.42.0
  • @openrouter/sdk^0.5.1