PkgRadar

Package evidence

[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
PublisherGitHub Actions
Artifact bytes1,117,288
Previous version1.29.0-canary.15
Published2026-05-22T18:33:22.599Z
SHA-2567e73ec0e96bf49933fbd96e47ebbc2ce324e9ca2569593226553af3050519a9c

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
168Score
1.29.0-canary.16Version
Status history (1 event)
  1. new → available · risk high · score 168 · status changed

Evidence

Static findings

29 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/src/browser.cjshigh encoded/escaped-token density12
mediumRemote Payloadpackage/dist/index.cjsmatched "cUrl "12
mediumObfuscation Densitypackage/dist/index.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/src/agents/index.cjshigh encoded/escaped-token density12
mediumRemote Payloadpackage/dist/src/react/index.cjsmatched "cUrl "12
mediumRemote Payloadpackage/dist/src/server/index.cjsmatched "cUrl "12
mediumRemote Payloadpackage/dist/chunk-2M2JEBVY.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/index.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/src/react/index.jsmatched "cUrl "12
Show all 29 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/src/browser.cjshigh encoded/escaped-token density12
mediumRemote Payloadpackage/dist/index.cjsmatched "cUrl "12
mediumObfuscation Densitypackage/dist/index.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/src/agents/index.cjshigh encoded/escaped-token density12
mediumRemote Payloadpackage/dist/src/react/index.cjsmatched "cUrl "12
mediumRemote Payloadpackage/dist/src/server/index.cjsmatched "cUrl "12
mediumRemote Payloadpackage/dist/chunk-2M2JEBVY.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/index.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/src/react/index.jsmatched "cUrl "12
lowObfuscationpackage/dist/src/browser.cjsmatched "\\u274C"3
lowObfuscationpackage/dist/src/client.cjsmatched "\\u274C"3
lowObfuscationpackage/dist/src/auth/index-node.cjsmatched "atob("3
lowObfuscationpackage/dist/index.cjsmatched "\\u274C"3
lowObfuscationpackage/dist/src/adapters/index.cjsmatched "\\u274C"3
lowObfuscationpackage/dist/src/agents/index.cjsmatched "\\u274C"3
lowObfuscationpackage/dist/src/auth/index.cjsmatched "atob("3
lowObfuscationpackage/dist/src/react/index.cjsmatched "\\u274C"3
lowObfuscationpackage/dist/src/server/index.cjsmatched "\\u274C"3
lowObfuscationpackage/dist/src/browser.jsmatched "\\u2705"3
lowObfuscationpackage/dist/chunk-7GLJGAAF.jsmatched "\\u26A0"3
lowObfuscationpackage/dist/chunk-MMRBRXYD.jsmatched "atob("3
lowObfuscationpackage/dist/chunk-NDBBBXYZ.jsmatched "\\u2705"3
lowObfuscationpackage/dist/chunk-PBRJ6OQS.jsmatched "atob("3
lowObfuscationpackage/dist/chunk-QWQYAQCK.jsmatched "\\u274C"3
lowObfuscationpackage/dist/chunk-T3NTW3VV.jsmatched "\\u26A0"3
lowObfuscationpackage/dist/display-T5DUYBJN.jsmatched "\\u2728"3
lowObfuscationpackage/dist/index.jsmatched "\\u2705"3
lowObfuscationpackage/dist/src/react/index.jsmatched "\\u2705"3
lowObfuscationpackage/dist/src/server/index.jsmatched "fromCharCode"3

Manifest

Package metadata

Scripts65
  • buildnpm run generate:version && rimraf dist && tsup && tsc --emitDeclarationOnly --declaration
  • example:add_servertsx examples/typescript/agent/server-management/add_server_tool.ts
  • example:ai_sdktsx examples/typescript/agent/frameworks/ai_sdk_example.ts
  • example:airbnbtsx examples/typescript/agent/integrations/airbnb_use.ts
  • example:blendertsx examples/typescript/agent/integrations/blender_use.ts
  • example:browsertsx examples/typescript/agent/integrations/browser_use.ts
  • example:browser:fulltsx examples/client/browser/full-features-example.ts
  • example:chattsx examples/typescript/agent/basic/chat_example.ts
  • example:client:completiontsx examples/client/node/communication/completion-client.ts
  • example:client:notificationtsx examples/client/node/communication/notification-client.ts
  • example:client:oauth:auth0tsx examples/typescript/server/oauth/auth0/src/server.ts
  • example:client:oauth:keycloaktsx examples/typescript/server/oauth/keycloak/src/server.ts
  • example:client:oauth:workostsx examples/typescript/server/oauth/workos/src/server.ts
  • example:client:samplingtsx examples/client/node/communication/sampling-client.ts
  • example:code_modetsx examples/typescript/agent/code-mode/code_mode_example.ts
  • example:code_mode_e2bsource .env 2>/dev/null || true && tsx examples/typescript/agent/code-mode/code_mode_e2b_example.ts
  • example:commonjsnode examples/client/browser/commonjs/commonjs_example.cjs
  • example:completionlsof -ti:3000 | xargs kill -9 2>/dev/null; tsx examples/server/features/completion/src/server.ts & sleep 6 && tsx examples/client/node/communication/completion-client.ts
  • example:everythingtsx examples/typescript/agent/basic/mcp_everything.ts
  • example:filesystemtsx examples/typescript/agent/integrations/filesystem_use.ts
  • example:httptsx examples/typescript/client/basic/http_example.ts
  • example:multitsx examples/typescript/agent/server-management/multi_server_example.ts
  • example:node:fulltsx examples/client/node/full-features-example.ts
  • example:notificationslsof -ti:3000 | xargs kill -9 2>/dev/null; tsx examples/server/features/notifications/src/server.ts & sleep 3 && tsx examples/client/node/communication/notification-client.ts
  • example:observabilitytsx examples/typescript/agent/advanced/observability.ts
  • example:samplinglsof -ti:3000 | xargs kill -9 2>/dev/null; tsx examples/server/features/sampling/src/server.ts & sleep 3 && tsx examples/client/node/communication/sampling-client.ts
  • example:server:completiontsx examples/server/features/completion/src/server.ts
  • example:server:dns-rebindingpnpm --dir examples/server/features/dns-rebinding dev
  • example:server:elicitationtsx examples/server/features/elicitation/src/server.ts
  • example:server:mcp-appstsx examples/server/ui/mcp-apps/index.ts
  • …and 35 more.
Dependencies12
  • @hono/node-server^1.19.13
  • @mcp-ui/server^6.1.0
  • @mcp-use/cli3.2.1-canary.16
  • @mcp-use/inspector7.0.0-canary.16
  • @modelcontextprotocol/ext-apps^1.0.1
  • @modelcontextprotocol/sdk^1.26.0
  • express^5.2.1
  • hono^4.12.12
  • jose^6.1.3
  • node-mocks-http^1.17.2
  • posthog-js^1.351.3
  • posthog-node^5.24.17
Optional dependencies3
  • chalk^5.6.2
  • cli-highlight^2.1.11
  • redis^5.10.0