PkgRadar

Package evidence

[email protected]

Obfuscation Density: high encoded/escaped-token density

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Artifact bytes1,724,699
Previous version1.0.0-alpha.4
Published2026-05-24T21:12:28.393Z
SHA-25686be7dcde8a71059c42a452bac46cace4b81ea8ff63fffb4c62469980e9f6852

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
921Score
1.0.0-alpha.5Version
Status history (1 event)
  1. newavailable · risk high · score 921 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

randomguy-2650

2 members · evidence strength 64

Evidence

Static findings

220 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/translations/ar.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/bg.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/bn.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/el-polyton.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/el.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/fa.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/gu.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/he.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/hi.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/hu.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ja.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ka.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/kk.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ko.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/lo.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/mr.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/pa-arab.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/pa.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ps.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ru.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/sr.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/te.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/th.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/uk.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ur.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/vi.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/zh-cn.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/zh-hk.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/zh-tw.jshigh encoded/escaped-token density12
Show all 220 findings (low-signal and informational)

Showing 60 of 220 findings.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/translations/ar.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/bg.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/bn.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/el-polyton.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/el.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/fa.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/gu.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/he.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/hi.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/hu.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ja.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ka.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/kk.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ko.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/lo.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/mr.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/pa-arab.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/pa.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ps.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ru.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/sr.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/te.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/th.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/uk.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/ur.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/vi.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/zh-cn.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/zh-hk.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/translations/zh-tw.jshigh encoded/escaped-token density12
lowObfuscationpackage/dist/internal/animate.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/translations/ar.jsmatched "\\u0627"3
lowObfuscationpackage/dist/translations/ar.jsmatched "\\u0627"3
lowObfuscationpackage/dist/components/avatar/avatar.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/translations/bg.jsmatched "\\u0411"3
lowObfuscationpackage/dist/translations/bg.jsmatched "\\u0411"3
lowObfuscationpackage/cdn/translations/bn.jsmatched "\\u09AC"3
lowObfuscationpackage/dist/translations/bn.jsmatched "\\u09AC"3
lowObfuscationpackage/cdn/translations/bs.jsmatched "\\u0161"3
lowObfuscationpackage/dist/translations/bs.jsmatched "\\u0161"3
lowObfuscationpackage/cdn/translations/ca.jsmatched "\\xE0"3
lowObfuscationpackage/dist/translations/ca.jsmatched "\\xE0"3
lowObfuscationpackage/dist/components/checkbox/checkbox.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/chunks/chunk.3NKZZTLK.jsmatched "\\xEA"3
lowObfuscationpackage/cdn/chunks/chunk.62L45PZI.jsmatched "\\xF1"3
lowObfuscationpackage/cdn/chunks/chunk.BSUF7VCA.jsmatched "\\xEB"3
lowObfuscationpackage/cdn/chunks/chunk.C7EGHFP3.jsmatched "\\xF6"3
lowObfuscationpackage/cdn/chunks/chunk.CYVY23NL.jsmatched "\\u201C"3
lowObfuscationpackage/cdn/chunks/chunk.ECC2BHPL.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/chunks/chunk.GNNNCEZF.jsmatched "\\u201C"3
lowObfuscationpackage/cdn/chunks/chunk.JKWXFGME.jsmatched "\\u201C"3
lowObfuscationpackage/cdn/chunks/chunk.KQPWYJ6U.jsmatched "\\u2019"3
lowObfuscationpackage/cdn/chunks/chunk.M6UZ2Q6Z.jsmatched "\\u202F"3
lowObfuscationpackage/cdn/chunks/chunk.MPZ7M4G3.jsmatched "\\u202F"3
lowObfuscationpackage/cdn/chunks/chunk.NQC6OGFN.jsmatched "\\xEA"3
lowObfuscationpackage/cdn/chunks/chunk.QUZH2MFB.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/chunks/chunk.RTO2GAOC.jsmatched "\\xE5"3
lowObfuscationpackage/cdn/chunks/chunk.RZZMGXAZ.jsmatched "\\u2010"3
lowObfuscationpackage/cdn/chunks/chunk.SURY7QNK.jsmatched "\\u2026"3
lowObfuscationpackage/cdn/chunks/chunk.ZT7Q4UY6.jsmatched "\\xE7"3
lowObfuscationpackage/dist/components/color-picker/color-picker.jsmatched "\\u201C"3

Manifest

Package metadata

Scripts6
  • buildnode ./scripts/build.js && pnpm generate_attribution
  • devnode ./scripts/build.js --watch
  • formatprettier --write --log-level=warn .
  • generate_attributionnode ./scripts/generate-attribution.js
  • linttsc --noEmit
  • prepublishOnlypnpm build
Dependencies6
  • @ctrl/tinycolor^4.2.0
  • @floating-ui/dom^1.7.4
  • composed-offset-position^0.0.6
  • lit^3.3.1
  • nanoid^5.1.6
  • qr-creator^1.0.0