Package evidence

[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 141Mature · −50% score
First published: Apr 2021
Publisher: publisheratlightrun

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherpublisheratlightrun

Artifact bytes101,205

Previous version1.85.0

Published2026-06-04T11:24:09.707Z

SHA-256ba1e1590e2b38cc89171abb238a7fe89e2dd8550edfc6a64f89dc86a99b3ca3e

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low

13d agoLast checked

lowRisk

0Score

1.86.0Version

Status history (2 events)

available → available13d ago · risk low · score 0 · status available -> available, risk review -> low, score 20 -> 0
new → available14d ago · risk review · score 20 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 2 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Obfuscation Density	package/build/src/agent/controller.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/build/src/agent/util/utils.js	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts21

api-extractorapi-extractor run --local
buildnpm run compile
cleangts clean
compiletsc -p .
compile-testtsc -p tsconfig.test.json
fixgts fix
lintgts check
lint-stagedlint-staged
obfuscatejavascript-obfuscator build -o build/ --config obfuscating-options.json
postcompileshx cp -r src/resources build/src && shx mkdir -p build/test/misc && shx cp -r test/misc/*.js build/test/misc && shx cp -r test/fixtures build/test
precompilegts clean
prepacknpm run obfuscate && npm run api-extractor && shx rm -r "build/src/**/*.d.ts" && shx cp build/types/index.d.ts build/src/index.d.ts
presystem-testnpm run compile-test
pretestnpm run compile-test
prettier:checkprettier --list-different "./{src,test,system-test}/**/*.ts"
prettier:formatprettier --write "./{src,test,system-test}/**/*.ts"
system-testMOCHA_REPORTER_OUTPUT=test-system.xml nyc mocha build/system-test --timeout 600000
testnpm run prettier:check && npm run lint && npm run test-unit
test-allnpm run build && npm run test && npm run system-test
test-singlenpm run compile-test && mocha --exit -p build/test/test-module.js
test-unitnyc cross-env CLOUD_DEBUG_ASSERTIONS=1 mocha --exit -p build/test --retries 2

Dependencies18

@google-cloud/common^6.0.0
acorn^8.15.0
axios^1.15.2
extend^3.0.2
findit2^2.2.3
https-proxy-agent^7.0.6
java-properties^1.0.2
js-yaml^4.1.1
memory-streams^0.1.3
p-limit^3.1.0
re2js^1.2.0
semver^7.7.3
source-map^0.6.1
split^1.0.1
triple-beam^1.4.1
winston^3.19.0
winston-daily-rotate-file^5.0.0
yup^1.7.1