PkgRadar

Package evidence

[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
409
Versions published
4
First published
May 2026
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes1,528,814
Previous version0.0.2
Published2026-05-19T16:31:38.870Z
SHA-256ba931fb1dd8fdf3fe806872a1d8a79137d95ec0e7ec9b3659ccbb9f6cb102a97

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
15Score
0.0.3Version
Status history (1 event)
  1. new → available · risk review · score 15 · status changed

Evidence

Static findings

39 static · 0 from release diff · showing high-signal first.

Showing 30 of 39 findings.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/locale/ar-dz.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/ar-ly.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/ar.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/be.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/bn-bd.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/bn.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/bo.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/el.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/gom-deva.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/gu.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/hi.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/hy-am.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/ka.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/kn.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/ku.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/ml.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/mn.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/mr.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/ne.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/pa-in.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/ru.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/sr-cyrl.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/ta.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/tg.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/ug-cn.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/uk.cjshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/ar-ly.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/ar.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/be.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/locale/bo.jshigh encoded/escaped-token density12

Manifest

Package metadata

Scripts49
  • audit:staticbun run knip && bun run fallow
  • benchbun test/bench.ts
  • bench:guardbun test/bench-regression.ts && bun test/bench-parse-eval.ts && bun test/bench-lookup.ts
  • bench:membun test/bench-mem.ts
  • buildrm -rf dist/entry && mkdir -p packages/timezone/node_modules && ln -sfn ../../.. packages/timezone/node_modules/mmntjs && for dir in test/kibana-compat test/grafana-compat; do mkdir -p "$dir/node_modules" && ln -sfn ../../../dist/index.js "$dir/node_modules/moment" && ln -sfn ../../../dist/index.js "$dir/node_modules/mmntjs" && ln -sfn ../../../packages/timezone/dist/index.js "$dir/node_modules/moment-timezone"; done && bun scripts/generate-timezone-data.ts && tsup && bun scripts/copy-dts.ts && bun scripts/generate-locale-auto.ts && rm -rf dist/locale/test-locales* && rm -f dist/locale/*.map && rm -rf dist/entry && bun -e "require('fs').readdirSync('dist',{recursive:true}).filter(f=>f.endsWith('.map')).forEach(f=>{const p='dist/'+f;const m=JSON.parse(require('fs').readFileSync(p,'utf8'));delete m.sourcesContent;require('fs').writeFileSync(p,JSON.stringify(m))})" && (cd packages/timezone && bun run build || true)
  • cibun run lint && TZ=UTC bun run test:hard && bun run test:tz && bun run build && bun run knip && bun run fallow
  • coverage:checkbun scripts/check-coverage.ts
  • coverage:heatmapbun run test:coverage && bun run fuzz:heatmap
  • docs:buildastro build --root site
  • docs:checkbun run scripts/check-site-doc-drift.ts
  • docs:devastro dev --root site
  • docs:previewastro preview --root site
  • fallowfallow
  • fmtoxfmt src test
  • fuzzbun run build && jazzer test/fuzz/parse.fuzz.js --sync -i dist/ -- -max_total_time=60 -minimize_crash=1
  • fuzz:corpus:initbun run scripts/fuzz-corpus-init.ts
  • fuzz:corpus:minimizebun run scripts/fuzz-corpus-minimize.ts
  • fuzz:corpus:replaybun run scripts/fuzz-corpus-replay.ts
  • fuzz:ddminbun test/fuzz/delta-debug.mjs
  • fuzz:diffjazzer test/fuzz/diff-datefns.fuzz.js --sync -i dist/ -- -runs=500 -max_len=16 && jazzer test/fuzz/diff-luxon.fuzz.js --sync -i dist/ -- -runs=500 -max_len=16 && jazzer test/fuzz/diff-dayjs.fuzz.js --sync -i dist/ -- -runs=500 -max_len=16
  • fuzz:grammarbun run build && jazzer test/fuzz/grammar.fuzz.js --sync -i dist/ -- -runs=10000 -max_len=48
  • fuzz:grammar:quickbun run build && jazzer test/fuzz/grammar.fuzz.js --sync -i dist/ -- -runs=500 -max_len=48
  • fuzz:heatmapbun run scripts/fuzz-coverage-heatmap.ts
  • fuzz:nightlybash scripts/fuzz-nightly.sh
  • fuzz:nightly:longbash scripts/fuzz-nightly.sh 600
  • fuzz:quickbun run build && jazzer test/fuzz/parse.fuzz.js --sync -i dist/ -- -runs=500 -max_len=64 && jazzer test/fuzz/format.fuzz.js --sync -i dist/ -- -runs=500 -max_len=64 && jazzer test/fuzz/duration.fuzz.js --sync -i dist/ -- -runs=500 -max_len=32 && jazzer test/fuzz/operations.fuzz.js --sync -i dist/ -- -runs=500 -max_len=32 && jazzer test/fuzz/array-input.fuzz.js --sync -i dist/ -- -runs=500 -max_len=32 && jazzer test/fuzz/utc.fuzz.js --sync -i dist/ -- -runs=500 -max_len=64 && jazzer test/fuzz/object-input.fuzz.js --sync -i dist/ -- -runs=500 -max_len=32 && jazzer test/fuzz/reltime.fuzz.js --sync -i dist/ -- -runs=500 && jazzer test/fuzz/diff-datefns.fuzz.js --sync -i dist/ -- -runs=500 -max_len=16 && jazzer test/fuzz/diff-luxon.fuzz.js --sync -i dist/ -- -runs=500 -max_len=16 && jazzer test/fuzz/diff-dayjs.fuzz.js --sync -i dist/ -- -runs=500 -max_len=16
  • fuzz:regression:addbun run scripts/fuzz-regression-add.ts
  • fuzz:regression:generatebun run scripts/fuzz-regression-generate-tests.ts
  • fuzz:regression:importbun run scripts/fuzz-regression-import-crashes.ts
  • fuzz:regression:replaybun run scripts/fuzz-regression-replay.ts
  • …and 19 more.