PkgRadar

Package evidence

[email protected]

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
631
Versions published
626Mature · −50% score
First published
Jul 2019
Publisher
ontotext-user

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherontotext-user
Artifact bytes20,166,344
Previous version3.3.3
Published2026-05-29T10:44:56.275Z
SHA-256176431d850811b2780d60e02013d2f10f64bce1a952ca84538bb8dee3b23cb4e

Why flagged

What the scanner saw

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
15Score
3.4.0-RC1Version
Status history (1 event)
  1. new → available · risk review · score 15 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highJs Split Join Obfuscationpackage/dist/res/swagger5/swagger-ui-bundle.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
highJs Split Join Obfuscationpackage/dist/res/swagger5/swagger-ui-es-bundle.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
Show all 5 findings (low-signal and informational)
SeverityKindPathDetailPoints
highJs Split Join Obfuscationpackage/dist/res/swagger5/swagger-ui-bundle.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
highJs Split Join Obfuscationpackage/dist/res/swagger5/swagger-ui-es-bundle.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40
lowLarge Javascript Payloadpackage/dist/workbench/workbench/13.4a8db69270815b5c.js2921494 bytes0
lowLarge Javascript Payloadpackage/dist/55297.31c9e6d8afe143832003.bundle.js2928577 bytes0
lowLarge Javascript Payloadpackage/dist/legacyWorkbench.406725e9d0dcd5dc81f6.js2039744 bytes0

Manifest

Package metadata

Scripts37
  • buildnpm run build-dev
  • build-devsh scripts/build.sh
  • build:apicd packages/api && npm run build
  • build:modulesconcurrently "npm run build:api" "npm run build:shared"
  • build:sharedcd packages/shared-components && npm run build
  • cleansh scripts/clean.sh
  • clean-installsh scripts/clean.sh && npm run install:local
  • copy-pluginssh scripts/copy-plugins.sh
  • cy:runsh scripts/cy.sh
  • dev:with-pluginsconcurrently "npm run start" "npm run watch:plugins"
  • hotdeploynode scripts/hotdeploy.js
  • install:cish scripts/install.sh && sh scripts/postinstall.sh
  • install:localsh scripts/install-local.sh && sh scripts/postinstall.sh
  • instrument:legacy-workbenchnpx nyc instrument --in-place --compact false --source-map --produce-source-map packages/legacy-workbench/src/js/angular
  • license-report-apinpx license-checker --production --json --customPath license-checker/license-checker-format.json --start packages/api --out packages/api/dist/license-checker.json
  • license-report-legacy-workbenchnpx license-checker --production --json --customPath license-checker/license-checker-format.json --start packages/legacy-workbench --out packages/legacy-workbench/dist/license-checker.json
  • license-report-root-confignpx license-checker --production --json --customPath license-checker/license-checker-format.json --start packages/root-config -out packages/root-config/dist/license-checker.json
  • license-report-shared-componentsnpx license-checker --production --json --customPath license-checker/license-checker-format.json --start packages/shared-components --out packages/shared-components/dist/license-checker.json
  • license-report-workbenchnpx license-checker --production --json --customPath license-checker/license-checker-format.json --start packages/workbench --out packages/workbench/dist/license-checker.json
  • lintsh scripts/lint.sh
  • lint-stagedlint-staged
  • postbuildwebpack --env BUILD_MODE=production --config=webpack.config.prod.js
  • postbuild-devwebpack --env BUILD_MODE=development --config=webpack.config.dev.js
  • prebuildnpm run license-report-api && npm run license-report-root-config && npm run license-report-legacy-workbench && npm run license-report-shared-components && npm run license-report-workbench
  • preparehusky
  • qanpm run clean-install && npm run start
  • sonarsh scripts/sonar.sh
  • startconcurrently "npm run watch:api" "npm run watch:shared" "npm run start-workbench-api" "npm run start-workbench" "npm run start-root"
  • start-rootnodemon --watch packages/root-config/src --watch packages/shared-components/src --ext js,ts,html,css --exec "webpack serve --port 9000 --host 0.0.0.0 --env BUILD_MODE=development --config webpack.config.dev.js"
  • start-workbenchcd packages/workbench && npm run start
  • …and 7 more.
Dependencies3
  • @single-spa/import-map-injector^2.0.2
  • graphdb-workbench-plugins^0.0.1-TR32
  • import-map-overrides^6.1.0