Package evidence
[email protected]
Known Indicator Filename: package/dashboard/dist-server/dashboard/src/server/routes/execution.js
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Known Indicator Filename: package/dashboard/dist-server/dashboard/src/server/routes/execution.js
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 339 · status changed
Related candidates
Linked campaigns and clusters
Known Indicator Filename — package/dashboard/dist-server/src/server/routes/execution.js
3 members · evidence strength 80Known Indicator Filename — package/dashboard/dist-server/dashboard/src/server/routes/execution.js
3 members · evidence strength 80dyw1234
3 members · evidence strength 74Evidence
Static findings
70 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/dashboard/dist-server/dashboard/src/server/routes/execution.js | package/dashboard/dist-server/dashboard/src/server/routes/execution.js | 45 |
| high | Known Indicator Filename | package/dashboard/dist-server/src/server/routes/execution.js | package/dashboard/dist-server/src/server/routes/execution.js | 45 |
| medium | Remote Payload | package/dist/src/commands/font-guide.js | matched "github.com/ryanoasis/nerd-fonts/releases/download" | 12 |
| medium | Remote Payload | package/dashboard/dist-server/dashboard/src/server/agents/gemini-a2a-adapter.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dashboard/dist-server/src/server/agents/gemini-a2a-adapter.js | matched "cUrl " | 12 |
| medium | Obfuscation Density | package/dist/src/commands/hooks.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/src/commands/spec.js | high encoded/escaped-token density | 12 |
Show all 70 findings (low-signal and informational)
Showing 60 of 70 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/dashboard/dist-server/dashboard/src/server/routes/execution.js | package/dashboard/dist-server/dashboard/src/server/routes/execution.js | 45 |
| high | Known Indicator Filename | package/dashboard/dist-server/src/server/routes/execution.js | package/dashboard/dist-server/src/server/routes/execution.js | 45 |
| medium | Remote Payload | package/dist/src/commands/font-guide.js | matched "github.com/ryanoasis/nerd-fonts/releases/download" | 12 |
| medium | Remote Payload | package/dashboard/dist-server/dashboard/src/server/agents/gemini-a2a-adapter.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dashboard/dist-server/src/server/agents/gemini-a2a-adapter.js | matched "cUrl " | 12 |
| medium | Obfuscation Density | package/dist/src/commands/hooks.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/src/commands/spec.js | high encoded/escaped-token density | 12 |
| low | Obfuscation | package/dist/src/commands/install-ui/BackupConfig.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/src/tui/install-ui/BackupConfig.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/src/commands/install-ui/BlueprintPreview.js | matched "\\u2514" | 3 |
| low | Obfuscation | package/dist/src/tui/install-ui/BlueprintPreview.js | matched "\\u2514" | 3 |
| low | Obfuscation | package/dashboard/dist-server/src/utils/cli-format.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/src/utils/cli-format.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/src/tui/config-ui/ConfigHub.js | matched "\\u2190" | 3 |
| low | Obfuscation | package/dist/src/commands/config-ui/ConfigSourcesView.js | matched "\\u25CF" | 3 |
| low | Obfuscation | package/dashboard/dist-server/src/hooks/constants.js | matched "\\uF0E7" | 3 |
| low | Obfuscation | package/dist/src/hooks/constants.js | matched "\\uF0E7" | 3 |
| low | Obfuscation | package/dist/src/tools/impeccable/design-parser.js | matched "\\u2018" | 3 |
| low | Obfuscation | package/dashboard/dist-server/src/coordinator/expr-evaluator.js | matched "eval(" | 3 |
| low | Obfuscation | package/dist/src/coordinator/expr-evaluator.js | matched "eval(" | 3 |
| low | Obfuscation | package/dist/src/tui/install-ui/ExtraMcpConfig.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/dashboard/dist-server/src/coordinator/graph-walker.js | matched "Eval(" | 3 |
| low | Obfuscation | package/dist/src/coordinator/graph-walker.js | matched "Eval(" | 3 |
| low | Obfuscation | package/dist/src/tui/shared/helpers.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/src/commands/hooks.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/src/tui/config-ui/HooksPanel.js | matched "\\u2691" | 3 |
| low | Obfuscation | package/dashboard/dist/assets/index-DQIlX2w_.js | matched "\\u00C0" | 3 |
| low | Obfuscation | package/dashboard/tui/dist/index.js | matched "\\u2022" | 3 |
| low | Obfuscation | package/dist/src/tools/impeccable/live/inject.js | matched "Buffer.from(origAttr.value, 'base64" | 3 |
| low | Obfuscation | package/dist/src/commands/install-ui/InstallResult.js | matched "\\u26A0" | 3 |
| low | Obfuscation | package/dist/src/tui/install-ui/InstallResult.js | matched "\\u26A0" | 3 |
| low | Obfuscation | package/dist/src/hooks/keyword-spec-injector.js | matched "\\u4e00" | 3 |
| low | Obfuscation | package/dist/src/commands/launcher.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/dist/src/tools/impeccable/live/static/live-browser.js | matched "\\u25BE" | 3 |
| low | Obfuscation | package/dashboard/dist/assets/MarkdownRenderer-ZGtOY7Ti.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/src/tools/impeccable/live/static/modern-screenshot.umd.js | matched "\\u0000" | 3 |
| low | Obfuscation | package/dist/src/commands/overlay-ui/OverlayList.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/dist/src/tui/overlay-ui/OverlayList.js | matched "\\u251c" | 3 |
| low | Obfuscation | package/dist/src/tools/impeccable/live/poll.js | matched "\\u26A0" | 3 |
| low | Obfuscation | package/dist/src/hooks/preflight-core.js | matched "\\u26a0" | 3 |
| low | Obfuscation | package/dist/src/commands/tools-ui/RegisterSettings.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/dist/src/tui/tools-ui/RegisterSettings.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/workflows/impeccable/ui-search/render-prototype.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/src/commands/tools-ui/RoleMappings.js | matched "\\u2191" | 3 |
| low | Obfuscation | package/dist/src/tui/tools-ui/RoleMappings.js | matched "\\u2191" | 3 |
| low | Obfuscation | package/dashboard/dist/assets/RoomsPage-CExTbOGr.js | matched "\\u4e00" | 3 |
| low | Obfuscation | package/dist/src/commands/config-ui/SkillConfigDashboard.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/src/commands/config-ui/SkillParamEditor.js | matched "\\u2191" | 3 |
| low | Obfuscation | package/dist/src/tui/config-ui/SkillParamEditor.js | matched "\\u2191" | 3 |
| low | Obfuscation | package/dist/src/commands/config-ui/SkillsList.js | matched "\\u2191" | 3 |
| low | Obfuscation | package/dist/src/tui/config-ui/SkillsList.js | matched "\\u2191" | 3 |
| low | Obfuscation | package/dashboard/dist-server/src/tools/spec-entry-parser.js | matched "\\u00b7" | 3 |
| low | Obfuscation | package/dist/src/tools/spec-entry-parser.js | matched "\\u00b7" | 3 |
| low | Obfuscation | package/dist/src/tools/spec-keyword-index.js | matched "\\u4e00" | 3 |
| low | Obfuscation | package/dashboard/dist-server/src/tools/spec-loader.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/dist/src/tools/spec-loader.js | matched "\\u2192" | 3 |
| low | Obfuscation | package/dist/src/commands/spec.js | matched "\\u26A0" | 3 |
| low | Obfuscation | package/dist/src/tui/config-ui/SpecAnalyticsPanel.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/src/tui/config-ui/SpecPanel.js | matched "\\u2190" | 3 |
| low | Obfuscation | package/dashboard/dist-server/dashboard/src/server/routes/specs.js | matched "\\u4e00" | 3 |
Manifest
Package metadata
Scripts8
buildcd dashboard && npx tsc -p tsconfig.node.json && cd .. && tsc && node -e "const fs=require('fs');const p=require('path');const s='src/tools/impeccable/live/static',d='dist/src/tools/impeccable/live/static';if(fs.existsSync(s)){fs.mkdirSync(d,{recursive:true});for(const f of fs.readdirSync(s)){fs.copyFileSync(p.join(s,f),p.join(d,f))}}"build:mirrorsnode scripts/convert-claude-to-agy.mjs && node scripts/build-agents-standard.mjscleanrm -rf distdevtsc --watchlinttsc --noEmitmcpnode bin/maestro-mcp.jsprepublishOnlynpm run build && npm run build:mirrorsstartnode bin/maestro.js
Dependencies20
@anthropic-ai/claude-agent-sdk^0.2.77@hono/node-server^1.14.0@inkjs/ui^2.0.0@inquirer/prompts^8.3.2@modelcontextprotocol/sdk^1.12.1argon2^0.44.0chokidar^4.0.0commander^13.1.0drizzle-orm^0.45.2hono^4.7.0ink^6.0.0ink-big-text^2.0.0ink-gradient^4.0.0ink-spinner^5.0.0marked^15.0.0node-cron^4.2.1pg^8.20.0react^19.0.0ws^8.19.0zod^4.0.0