Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Remote Payload: matched "raw.githubusercontent.com"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 105 · status changed
Related candidates
Linked campaigns and clusters
ay.pineau
2 members · evidence strength 64Evidence
Static findings
20 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/client/dist/assets/MarkDownRender-C8K2RDjG.js | matched "raw.githubusercontent.com" | 12 |
| medium | Obfuscation Density | package/client/dist/assets/blade-B5sHZh5P.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/client/dist/assets/index-CNTZ-LFA.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/client/dist/assets/julia-DM1LmkEE.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/client/dist/assets/php-D9q_KGsS.js | high encoded/escaped-token density | 12 |
Show all 20 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/client/dist/assets/MarkDownRender-C8K2RDjG.js | matched "raw.githubusercontent.com" | 12 |
| medium | Obfuscation Density | package/client/dist/assets/blade-B5sHZh5P.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/client/dist/assets/index-CNTZ-LFA.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/client/dist/assets/julia-DM1LmkEE.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/client/dist/assets/php-D9q_KGsS.js | high encoded/escaped-token density | 12 |
| low | Obfuscation | package/client/dist/assets/MarkDownRender-C8K2RDjG.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/client/dist/assets/blade-B5sHZh5P.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/client/dist/assets/bundle-web-C5Yf7ySe.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/client/dist/assets/coffee-DOXkiwK5.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/client/dist/assets/css-Ce7Cq_kZ.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/client/dist/assets/html-CL73O1EU.js | matched "\\x00" | 3 |
| low | Obfuscation | package/client/dist/assets/index-CNTZ-LFA.js | matched "\\u00C0" | 3 |
| low | Obfuscation | package/client/dist/assets/julia-DM1LmkEE.js | matched "\\x01" | 3 |
| low | Obfuscation | package/client/dist/assets/less-BZni_5-V.js | matched "\\x00" | 3 |
| low | Obfuscation | package/client/dist/assets/php-D9q_KGsS.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/client/dist/assets/purify.es-DF7xWCvs.js | matched "\\u00B7" | 3 |
| low | Obfuscation | package/client/dist/assets/scss-vGlQxEP8.js | matched "\\x00" | 3 |
| low | Obfuscation | package/client/dist/assets/stylus-DlF1uTDd.js | matched "\\x00" | 3 |
| low | Obfuscation | package/client/dist/assets/vue-DFnIl2P0.js | matched "\\x00" | 3 |
| low | Obfuscation | package/client/dist/assets/wasm-5vXz1uVy.js | matched "atob(" | 3 |
Manifest
Package metadata
Scripts22
buildbun build:client && bun build:serverbuild:cibun build:client:ci && bun build:server:cibuild:clientbun build:client:cibuild:client:cibun --bun vite build --config ./client/vite.config.tsbuild:serverbun build:server:cibuild:server:cibun --bun tsdown --config ./server/tsdown.config.ts --tsconfig ./server/tsconfig.jsondev:clientbun --bun vite dev --config ./client/vite.config.tsdev:serverbun --watch --hot ./server/src/index.tsformatbun --bun biome format . --checkformat:fixbun --bun biome format --write .lintbun --bun biome lint .lint:fixbun --bun biome lint --write .previewbun --bun vite preview --config ./client/vite.config.tspublishbun publish || truepublish:canarybun publish --access public --tag canary || truepublish:latestbun publish --access public --tag latest || truestartbun server/dist/esm/index.mjsstart:clientbun --bun vite preview --config ./client/vite.config.tsstart:serverbun --watch --hot ./server/dist/esm/index.mjstestbun --bun vitest runtest:watchbun --bun vitesttypechecktsc --project ./server/tsconfig.types.json --noEmit
Dependencies12
@fastify/compress8.3.1@fastify/cookie11.0.2@fastify/cors11.2.0@fastify/formbody8.0.2@fastify/helmet13.0.2@fastify/static9.1.3@intlayer/chokidar8.10.0@intlayer/config8.10.1@intlayer/unmerged-dictionaries-entry8.10.1fastify5.8.5fastify-intlayer8.10.0mime4.1.0