PkgRadar

Package evidence

[email protected]

Obfuscation Density: high encoded/escaped-token density

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Artifact bytes1,317,658
Previous version1.0.0-alpha.3
Published2026-02-21T20:03:58.862Z
SHA-2565cab7feee018a167349d410674735c06f38ed6e492158b4429be2196bab4f332

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
610Score
1.0.0-alpha.4Version
Status history (1 event)
  1. newavailable · risk high · score 610 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

randomguy-2650

2 members · evidence strength 64

Evidence

Static findings

191 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/translations/el-polyton.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/el.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ru.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/uk.jshigh encoded/escaped-token density12
Show all 191 findings (low-signal and informational)

Showing 60 of 191 findings.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/translations/el-polyton.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/el.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ru.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/uk.jshigh encoded/escaped-token density12
lowInstall-time lifecycle scriptpackage.jsonprepare="husky"4
lowObfuscationpackage/dist/internal/animate.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/translations/ar.jsmatched "\\u0627"3
lowObfuscationpackage/dist/translations/ar.jsmatched "\\u0627"3
lowObfuscationpackage/dist/components/avatar/avatar.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/translations/bg.jsmatched "\\u0411"3
lowObfuscationpackage/dist/translations/bg.jsmatched "\\u0411"3
lowObfuscationpackage/cdn/translations/bn.jsmatched "\\u09AC"3
lowObfuscationpackage/dist/translations/bn.jsmatched "\\u09AC"3
lowObfuscationpackage/cdn/translations/bs.jsmatched "\\u0161"3
lowObfuscationpackage/dist/translations/bs.jsmatched "\\u0161"3
lowObfuscationpackage/cdn/translations/ca.jsmatched "\\xE0"3
lowObfuscationpackage/dist/translations/ca.jsmatched "\\xE0"3
lowObfuscationpackage/dist/components/checkbox/checkbox.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/chunks/chunk.3C3WX3MJ.jsmatched "\\u201C"3
lowObfuscationpackage/cdn/chunks/chunk.3MBXGS36.jsmatched "\\u2026"3
lowObfuscationpackage/cdn/chunks/chunk.4Q2NU4EV.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/chunks/chunk.CC3VXLJW.jsmatched "\\xEB"3
lowObfuscationpackage/cdn/chunks/chunk.CGMWMG67.jsmatched "\\xF1"3
lowObfuscationpackage/cdn/chunks/chunk.F2A6AG4Y.jsmatched "\\u202F"3
lowObfuscationpackage/cdn/chunks/chunk.GFJ7IMYB.jsmatched "\\xEA"3
lowObfuscationpackage/cdn/chunks/chunk.GOIDHRQ2.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/chunks/chunk.N4SKB24D.jsmatched "\\u2019"3
lowObfuscationpackage/cdn/chunks/chunk.N5CBIVHQ.jsmatched "\\u201C"3
lowObfuscationpackage/cdn/chunks/chunk.RXUC6CD7.jsmatched "\\u7B80"3
lowObfuscationpackage/cdn/chunks/chunk.RZ7MI7RK.jsmatched "\\xEA"3
lowObfuscationpackage/cdn/chunks/chunk.RZZMGXAZ.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/chunks/chunk.TRD7J2AV.jsmatched "\\xF6"3
lowObfuscationpackage/cdn/chunks/chunk.YGOGRRPX.jsmatched "\\u2019"3
lowObfuscationpackage/cdn/chunks/chunk.YTNFWAX6.jsmatched "\\u202F"3
lowObfuscationpackage/cdn/chunks/chunk.ZEQBZONA.jsmatched "\\xE5"3
lowObfuscationpackage/cdn/chunks/chunk.ZPHZCJBG.jsmatched "\\u201C"3
lowObfuscationpackage/cdn/chunks/chunk.ZVZAEQC2.jsmatched "\\xE7"3
lowObfuscationpackage/dist/components/color-picker/color-picker.jsmatched "\\u201C"3
lowObfuscationpackage/dist/components/comparer/comparer.jsmatched "\\u201C"3
lowObfuscationpackage/dist/components/copy-button/copy-button.jsmatched "\\u201C"3
lowObfuscationpackage/cdn/translations/cs.jsmatched "\\u010C"3
lowObfuscationpackage/dist/translations/cs.jsmatched "\\u010C"3
lowObfuscationpackage/cdn/translations/cy.jsmatched "\\xE9"3
lowObfuscationpackage/dist/translations/cy.jsmatched "\\xE9"3
lowObfuscationpackage/cdn/translations/da.jsmatched "\\xE6"3
lowObfuscationpackage/dist/translations/da.jsmatched "\\xE6"3
lowObfuscationpackage/cdn/translations/de-at.jsmatched "\\xD6"3
lowObfuscationpackage/dist/translations/de-at.jsmatched "\\xF6"3
lowObfuscationpackage/cdn/translations/de-ch.jsmatched "\\xF6"3
lowObfuscationpackage/dist/translations/de-ch.jsmatched "\\xF6"3
lowObfuscationpackage/dist/translations/de.jsmatched "\\xF6"3
lowObfuscationpackage/dist/components/details/details.jsmatched "\\u2010"3
lowObfuscationpackage/dist/components/dialog/dialog.jsmatched "\\u2010"3
lowObfuscationpackage/dist/components/drawer/drawer.jsmatched "\\u2010"3
lowObfuscationpackage/dist/components/dropdown-item/dropdown-item.jsmatched "\\u2010"3
lowObfuscationpackage/dist/components/dropdown/dropdown.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/translations/el-polyton.jsmatched "\\u1F19"3
lowObfuscationpackage/dist/translations/el-polyton.jsmatched "\\u1F19"3
lowObfuscationpackage/cdn/translations/el.jsmatched "\\u0395"3
lowObfuscationpackage/dist/translations/el.jsmatched "\\u0395"3

Manifest

Package metadata

Scripts6
  • buildnode ./scripts/build.js && npm run generate_attribution
  • formatprettier --write --log-level=warn .
  • generate_attributionnode ./scripts/generate-attribution.js
  • linttsc --noEmit
  • preparehusky
  • prepublishOnlynpm run build
Dependencies6
  • @ctrl/tinycolor^4.2.0
  • @floating-ui/dom^1.7.4
  • composed-offset-position^0.0.6
  • lit^3.3.1
  • nanoid^5.1.6
  • qr-creator^1.0.0