Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Obfuscation Density: high encoded/escaped-token density
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 784 · status changed
Related candidates
Linked campaigns and clusters
stevenvelozo
6 members · evidence strength 84Evidence
Static findings
109 static · 0 from release diff · showing high-signal first.
Showing 30 of 51 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ar-SA-NXDWD63E.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/az-AZ-MXSORGZV.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/bg-BG-O6MV2KSF.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/bn-BD-T2VJNT7N.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/bn-IN-MMW2ORAC.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ca-ES-MKBCGNOG.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/cs-CZ-V77HGUP7.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/de-CH-WLRDEVBV.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/de-DE-DTI4WUSC.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/el-GR-ZXDJ2OS4.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/es-ES-DYQHAD43.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/fa-IR-26LZG4PM.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/fi-FI-6YS4KDE4.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/fr-FR-BRLLPTZC.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/gl-ES-OKUZTLYG.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/he-IL-26MGYIU7.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/hi-IN-Q4ZOGTP2.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/hu-HU-P2OXPSN5.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ja-JP-MAND2Z4V.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/kaa-HQRTCXTJ.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/kab-KAB-JKIKKTGH.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/kk-KZ-HXQ63ZFC.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/km-KH-PKL3LSGX.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ko-KR-KXLREZX3.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ku-TR-MJ4IER3X.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/lt-LT-H6WFQ6FJ.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/lv-LV-GOCK6SJW.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/mr-IN-IXVLDMEQ.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/my-MM-YG6MYTTD.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/nb-NO-XGWJISD2.js | high encoded/escaped-token density | 12 |
Show all 109 findings (low-signal and informational)
Showing 60 of 109 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ar-SA-NXDWD63E.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/az-AZ-MXSORGZV.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/bg-BG-O6MV2KSF.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/bn-BD-T2VJNT7N.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/bn-IN-MMW2ORAC.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ca-ES-MKBCGNOG.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/cs-CZ-V77HGUP7.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/de-CH-WLRDEVBV.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/de-DE-DTI4WUSC.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/el-GR-ZXDJ2OS4.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/es-ES-DYQHAD43.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/fa-IR-26LZG4PM.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/fi-FI-6YS4KDE4.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/fr-FR-BRLLPTZC.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/gl-ES-OKUZTLYG.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/he-IL-26MGYIU7.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/hi-IN-Q4ZOGTP2.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/hu-HU-P2OXPSN5.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ja-JP-MAND2Z4V.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/kaa-HQRTCXTJ.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/kab-KAB-JKIKKTGH.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/kk-KZ-HXQ63ZFC.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/km-KH-PKL3LSGX.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ko-KR-KXLREZX3.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ku-TR-MJ4IER3X.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/lt-LT-H6WFQ6FJ.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/lv-LV-GOCK6SJW.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/mr-IN-IXVLDMEQ.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/my-MM-YG6MYTTD.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/nb-NO-XGWJISD2.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/nn-NO-EMX5MJX5.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/oc-FR-ROEINTVO.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/pa-IN-ZYN6SUDY.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/pl-PL-6VTG7PHC.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/pt-BR-5YFKRR5G.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/pt-PT-GEIXXZ67.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ro-RO-E2P6TFZI.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ru-RU-YBIIY43T.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/si-LK-673C2CI2.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/sk-SK-CKZHQ4AP.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/sl-SI-557H2GWM.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/sv-SE-XOPKKDWS.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/ta-IN-XBH7DQI3.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/th-TH-TOCWH3R4.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/tr-TR-GXW6CYY5.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/uk-UA-IJKTNUDG.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/vi-VN-MULSGNVB.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/zh-CN-MVX3E32U.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/zh-HK-JNU5RLIE.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/excalidraw-built/assets/locales/zh-TW-LENVCA6T.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/vendor/excalidraw-built/excalidraw-wrapper.min.js | 8384036 bytes | 10 |
| low | Obfuscation | package/vendor/excalidraw-built/assets/locales/ar-SA-NXDWD63E.js | matched "\\u0644" | 3 |
| low | Obfuscation | package/vendor/excalidraw-built/assets/locales/az-AZ-MXSORGZV.js | matched "\\u0131" | 3 |
| low | Obfuscation | package/vendor/excalidraw-built/assets/locales/bg-BG-O6MV2KSF.js | matched "\\u041F" | 3 |
| low | Obfuscation | package/vendor/excalidraw-built/assets/locales/bn-BD-T2VJNT7N.js | matched "\\u09AA" | 3 |
| low | Obfuscation | package/vendor/excalidraw-built/assets/locales/bn-IN-MMW2ORAC.js | matched "\\u09AA" | 3 |
| low | Obfuscation | package/vendor/excalidraw-built/assets/locales/ca-ES-MKBCGNOG.js | matched "\\xF3" | 3 |
| low | Obfuscation | package/vendor/excalidraw-built/assets/chunk-LOOWOR4L.js | matched "\\u2026" | 3 |
| low | Obfuscation | package/vendor/excalidraw-built/assets/chunk-UGWADJQO.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/vendor/excalidraw-built/assets/locales/cs-CZ-V77HGUP7.js | matched "\\u017E" | 3 |
Manifest
Package metadata
Scripts9
buildnpx quack buildbuild:vendornode scripts/Build-Vendor-Bundles.jscoverage./node_modules/.bin/nyc --reporter=lcov --reporter=text-lcov ./node_modules/mocha/bin/_mocha -- -u tdd -R specexamplenpx quack examplesgenerate-diagramnode scripts/Generate-Notebook-Diagram.jsstartnode source/Pict-Section-Excalidraw.jstestmocha -u tdd -R spectest:e2enode test/puppeteer/Notebook-Generator-E2E.jstestsmocha -u tdd -R spec -g
Dependencies2
chai^4.5.0pict-view^1.0.68