PkgRadar

Package evidence

[email protected]

Obfuscation Density: high encoded/escaped-token density

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherstevenvelozo
Artifact bytes17,072,426
Previous versionnone
Published2026-05-25T00:20:28.126Z
SHA-256445b533ff4a152260c6d6c9fec7af703866cf79ec7c417efefc8c0d5ef0f790d

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
784Score
1.0.0Version
Status history (1 event)
  1. newavailable · risk high · score 784 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

stevenvelozo

6 members · evidence strength 84

Evidence

Static findings

109 static · 0 from release diff · showing high-signal first.

Showing 30 of 51 findings.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ar-SA-NXDWD63E.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/az-AZ-MXSORGZV.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/bg-BG-O6MV2KSF.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/bn-BD-T2VJNT7N.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/bn-IN-MMW2ORAC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ca-ES-MKBCGNOG.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/cs-CZ-V77HGUP7.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/de-CH-WLRDEVBV.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/de-DE-DTI4WUSC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/el-GR-ZXDJ2OS4.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/es-ES-DYQHAD43.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/fa-IR-26LZG4PM.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/fi-FI-6YS4KDE4.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/fr-FR-BRLLPTZC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/gl-ES-OKUZTLYG.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/he-IL-26MGYIU7.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/hi-IN-Q4ZOGTP2.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/hu-HU-P2OXPSN5.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ja-JP-MAND2Z4V.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/kaa-HQRTCXTJ.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/kab-KAB-JKIKKTGH.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/kk-KZ-HXQ63ZFC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/km-KH-PKL3LSGX.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ko-KR-KXLREZX3.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ku-TR-MJ4IER3X.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/lt-LT-H6WFQ6FJ.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/lv-LV-GOCK6SJW.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/mr-IN-IXVLDMEQ.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/my-MM-YG6MYTTD.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/nb-NO-XGWJISD2.jshigh encoded/escaped-token density12
Show all 109 findings (low-signal and informational)

Showing 60 of 109 findings.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ar-SA-NXDWD63E.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/az-AZ-MXSORGZV.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/bg-BG-O6MV2KSF.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/bn-BD-T2VJNT7N.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/bn-IN-MMW2ORAC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ca-ES-MKBCGNOG.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/cs-CZ-V77HGUP7.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/de-CH-WLRDEVBV.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/de-DE-DTI4WUSC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/el-GR-ZXDJ2OS4.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/es-ES-DYQHAD43.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/fa-IR-26LZG4PM.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/fi-FI-6YS4KDE4.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/fr-FR-BRLLPTZC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/gl-ES-OKUZTLYG.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/he-IL-26MGYIU7.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/hi-IN-Q4ZOGTP2.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/hu-HU-P2OXPSN5.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ja-JP-MAND2Z4V.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/kaa-HQRTCXTJ.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/kab-KAB-JKIKKTGH.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/kk-KZ-HXQ63ZFC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/km-KH-PKL3LSGX.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ko-KR-KXLREZX3.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ku-TR-MJ4IER3X.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/lt-LT-H6WFQ6FJ.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/lv-LV-GOCK6SJW.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/mr-IN-IXVLDMEQ.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/my-MM-YG6MYTTD.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/nb-NO-XGWJISD2.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/nn-NO-EMX5MJX5.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/oc-FR-ROEINTVO.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/pa-IN-ZYN6SUDY.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/pl-PL-6VTG7PHC.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/pt-BR-5YFKRR5G.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/pt-PT-GEIXXZ67.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ro-RO-E2P6TFZI.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ru-RU-YBIIY43T.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/si-LK-673C2CI2.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/sk-SK-CKZHQ4AP.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/sl-SI-557H2GWM.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/sv-SE-XOPKKDWS.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/ta-IN-XBH7DQI3.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/th-TH-TOCWH3R4.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/tr-TR-GXW6CYY5.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/uk-UA-IJKTNUDG.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/vi-VN-MULSGNVB.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/zh-CN-MVX3E32U.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/zh-HK-JNU5RLIE.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/vendor/excalidraw-built/assets/locales/zh-TW-LENVCA6T.jshigh encoded/escaped-token density12
mediumLarge Javascript Payloadpackage/vendor/excalidraw-built/excalidraw-wrapper.min.js8384036 bytes10
lowObfuscationpackage/vendor/excalidraw-built/assets/locales/ar-SA-NXDWD63E.jsmatched "\\u0644"3
lowObfuscationpackage/vendor/excalidraw-built/assets/locales/az-AZ-MXSORGZV.jsmatched "\\u0131"3
lowObfuscationpackage/vendor/excalidraw-built/assets/locales/bg-BG-O6MV2KSF.jsmatched "\\u041F"3
lowObfuscationpackage/vendor/excalidraw-built/assets/locales/bn-BD-T2VJNT7N.jsmatched "\\u09AA"3
lowObfuscationpackage/vendor/excalidraw-built/assets/locales/bn-IN-MMW2ORAC.jsmatched "\\u09AA"3
lowObfuscationpackage/vendor/excalidraw-built/assets/locales/ca-ES-MKBCGNOG.jsmatched "\\xF3"3
lowObfuscationpackage/vendor/excalidraw-built/assets/chunk-LOOWOR4L.jsmatched "\\u2026"3
lowObfuscationpackage/vendor/excalidraw-built/assets/chunk-UGWADJQO.jsmatched "fromCharCode"3
lowObfuscationpackage/vendor/excalidraw-built/assets/locales/cs-CZ-V77HGUP7.jsmatched "\\u017E"3

Manifest

Package metadata

Scripts9
  • buildnpx quack build
  • build:vendornode scripts/Build-Vendor-Bundles.js
  • coverage./node_modules/.bin/nyc --reporter=lcov --reporter=text-lcov ./node_modules/mocha/bin/_mocha -- -u tdd -R spec
  • examplenpx quack examples
  • generate-diagramnode scripts/Generate-Notebook-Diagram.js
  • startnode source/Pict-Section-Excalidraw.js
  • testmocha -u tdd -R spec
  • test:e2enode test/puppeteer/Notebook-Generator-E2E.js
  • testsmocha -u tdd -R spec -g
Dependencies2
  • chai^4.5.0
  • pict-view^1.0.68