Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Remote Payload: matched "raw.githubusercontent.com"
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 62 · status changed
Related candidates
Linked campaigns and clusters
meshiest
2 members · evidence strength 56Evidence
Static findings
9 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/.claude/settings.local.json | matched "raw.githubusercontent.com" | 12 |
| medium | Remote Payload | package/tools/install_launcher.sh | matched "wget " | 12 |
| medium | Remote Payload | package/tools/install_steamcmd.sh | matched "wget " | 12 |
| medium | Large Javascript Payload | package/public/assets/shared/@tabler_icons-react-DrVFX3uL.js | 3566952 bytes | 10 |
Show all 9 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/.claude/settings.local.json | matched "raw.githubusercontent.com" | 12 |
| medium | Remote Payload | package/tools/install_launcher.sh | matched "wget " | 12 |
| medium | Remote Payload | package/tools/install_steamcmd.sh | matched "wget " | 12 |
| medium | Large Javascript Payload | package/public/assets/shared/@tabler_icons-react-DrVFX3uL.js | 3566952 bytes | 10 |
| low | Install-time lifecycle script | package.json | prepare="ts-patch install" | 4 |
| low | Obfuscation | package/public/assets/client-BT1QYH0O.js | matched "\\u00C0" | 3 |
| low | Obfuscation | package/public/assets/index-BDkarAkX.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/webserver/backend/index.js | matched "Buffer.from(passkey.publicKey, \"base64" | 3 |
| low | Obfuscation | package/dist/updater/steam.js | matched "\\x1b" | 3 |
Manifest
Package metadata
Scripts13
buildnpx vite build -c vite.backend.config.mtsbuild:frontendnpx vite build -c vite.frontend.config.mtsbuild:oldnpx tspc --build "src/"checkeslintdistnpm run build:frontend && npm run build && npm run dtsdtsnpx dts-bundle-generator --inline-declare-global --no-banner --no-check --external-inlines brs-js -o templates/safe-ts/omegga.d.ts -- ./src/plugin.tslintnpx prettier --check "src/" "frontend/src"lint:fixnpx prettier --write "src/" "frontend/src/"preparets-patch installstartnode --enable-source-maps index.jstestnpm run test:backendtest:backendvitest --config vitest.backend.config.mts --dir ./srcwatchnpm run build:frontend -- --watch
Dependencies44
@simplewebauthn/browser^13.3.0@simplewebauthn/server^13.3.0@swc/core^1.2.173@tanstack/react-query^5.90.21@trpc/client^11.12.0@trpc/react-query^11.12.0@trpc/server^11.12.0bcryptjs^2.4.3better-sqlite3^12.2.0body-parser^1.19.0brs-js^2.1.3child_process^1.0.2chokidar^3.4.2colors^1.4.0commander^5.1.0configstore^5.0.1dateformat^5.0.3disrequire^1.1.1dotenv^17.2.3express^4.18.2express-session^1.17.3glob^7.1.6hasbin^1.2.3js-yaml^4.1.0json-rpc-2.0^1.7.1lodash^4.17.21nedb-promises^5.0.1nedb-promises-session-store1.0.0otpauth^9.5.1pako^2.1.0- …and 14 more.