Package evidence
[email protected]
Known Indicator Filename: package/build/playcanvas.dbg/src/framework/bundle/bundle.js
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Publisher
- GitHub ActionsTrusted automation · −70% score
Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Known Indicator Filename: package/build/playcanvas.dbg/src/framework/bundle/bundle.js
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 482 · status changed
Related candidates
Linked campaigns and clusters
Known Indicator Filename — package/build/playcanvas/src/framework/handlers/bundle.js
2 members · evidence strength 70Known Indicator Filename — package/build/playcanvas/src/framework/bundle/bundle.js
2 members · evidence strength 70Known Indicator Filename — package/build/playcanvas.prf/src/framework/handlers/bundle.js
2 members · evidence strength 70Known Indicator Filename — package/build/playcanvas.prf/src/framework/bundle/bundle.js
2 members · evidence strength 70Known Indicator Filename — package/build/playcanvas.dbg/src/framework/handlers/bundle.js
2 members · evidence strength 70Known Indicator Filename — package/build/playcanvas.dbg/src/framework/bundle/bundle.js
2 members · evidence strength 70Evidence
Static findings
58 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/build/playcanvas.dbg/src/framework/bundle/bundle.js | package/build/playcanvas.dbg/src/framework/bundle/bundle.js | 45 |
| high | Known Indicator Filename | package/build/playcanvas.dbg/src/framework/handlers/bundle.js | package/build/playcanvas.dbg/src/framework/handlers/bundle.js | 45 |
| high | Known Indicator Filename | package/build/playcanvas.prf/src/framework/bundle/bundle.js | package/build/playcanvas.prf/src/framework/bundle/bundle.js | 45 |
| high | Known Indicator Filename | package/build/playcanvas.prf/src/framework/handlers/bundle.js | package/build/playcanvas.prf/src/framework/handlers/bundle.js | 45 |
| high | Known Indicator Filename | package/build/playcanvas/src/framework/bundle/bundle.js | package/build/playcanvas/src/framework/bundle/bundle.js | 45 |
| high | Known Indicator Filename | package/build/playcanvas/src/framework/handlers/bundle.js | package/build/playcanvas/src/framework/handlers/bundle.js | 45 |
| medium | Large Javascript Payload | package/build/playcanvas.dbg.js | 22548626 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.js | 3823900 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.min.js | 2296190 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.prf.js | 3830164 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.dbg.mjs | 21809970 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.min.mjs | 2304676 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.mjs | 3695453 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.prf.mjs | 3701541 bytes | 10 |
Show all 58 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/build/playcanvas.dbg/src/framework/bundle/bundle.js | package/build/playcanvas.dbg/src/framework/bundle/bundle.js | 45 |
| high | Known Indicator Filename | package/build/playcanvas.dbg/src/framework/handlers/bundle.js | package/build/playcanvas.dbg/src/framework/handlers/bundle.js | 45 |
| high | Known Indicator Filename | package/build/playcanvas.prf/src/framework/bundle/bundle.js | package/build/playcanvas.prf/src/framework/bundle/bundle.js | 45 |
| high | Known Indicator Filename | package/build/playcanvas.prf/src/framework/handlers/bundle.js | package/build/playcanvas.prf/src/framework/handlers/bundle.js | 45 |
| high | Known Indicator Filename | package/build/playcanvas/src/framework/bundle/bundle.js | package/build/playcanvas/src/framework/bundle/bundle.js | 45 |
| high | Known Indicator Filename | package/build/playcanvas/src/framework/handlers/bundle.js | package/build/playcanvas/src/framework/handlers/bundle.js | 45 |
| medium | Large Javascript Payload | package/build/playcanvas.dbg.js | 22548626 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.js | 3823900 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.min.js | 2296190 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.prf.js | 3830164 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.dbg.mjs | 21809970 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.min.mjs | 2304676 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.mjs | 3695453 bytes | 10 |
| medium | Large Javascript Payload | package/build/playcanvas.prf.mjs | 3701541 bytes | 10 |
| low | Obfuscation | package/build/playcanvas.dbg/src/framework/anim/evaluator/anim-cache.js | matched "eval(" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/framework/anim/evaluator/anim-cache.js | matched "eval(" | 3 |
| low | Obfuscation | package/build/playcanvas/src/framework/anim/evaluator/anim-cache.js | matched "eval(" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/framework/anim/evaluator/anim-clip.js | matched "eval(" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/framework/anim/evaluator/anim-clip.js | matched "eval(" | 3 |
| low | Obfuscation | package/build/playcanvas/src/framework/anim/evaluator/anim-clip.js | matched "eval(" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/framework/anim/evaluator/anim-track.js | matched "eval(" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/framework/anim/evaluator/anim-track.js | matched "eval(" | 3 |
| low | Obfuscation | package/build/playcanvas/src/framework/anim/evaluator/anim-track.js | matched "eval(" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/core/math/blue-noise.js | matched "atob(" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/core/math/blue-noise.js | matched "atob(" | 3 |
| low | Obfuscation | package/build/playcanvas/src/core/math/blue-noise.js | matched "atob(" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/scene/shader-lib/wgsl/chunks/gsplat/compute-gsplat-local-tile-count-large.js | matched "Eval(" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/scene/shader-lib/wgsl/chunks/gsplat/compute-gsplat-local-tile-count-large.js | matched "Eval(" | 3 |
| low | Obfuscation | package/build/playcanvas/src/scene/shader-lib/wgsl/chunks/gsplat/compute-gsplat-local-tile-count-large.js | matched "Eval(" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/scene/shader-lib/wgsl/chunks/gsplat/compute-gsplat-local-tile-count.js | matched "Eval(" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/scene/shader-lib/wgsl/chunks/gsplat/compute-gsplat-local-tile-count.js | matched "Eval(" | 3 |
| low | Obfuscation | package/build/playcanvas/src/scene/shader-lib/wgsl/chunks/gsplat/compute-gsplat-local-tile-count.js | matched "Eval(" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/scene/shader-lib/wgsl/chunks/gsplat/compute-gsplat-tile-intersect.js | matched "Eval(" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/scene/shader-lib/wgsl/chunks/gsplat/compute-gsplat-tile-intersect.js | matched "Eval(" | 3 |
| low | Obfuscation | package/build/playcanvas/src/scene/shader-lib/wgsl/chunks/gsplat/compute-gsplat-tile-intersect.js | matched "Eval(" | 3 |
| low | Obfuscation | package/scripts/utils/download-texture.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/framework/parsers/glb-parser.js | matched "\\u2028" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/framework/parsers/glb-parser.js | matched "\\u2028" | 3 |
| low | Obfuscation | package/build/playcanvas/src/framework/parsers/glb-parser.js | matched "\\u2028" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/extras/input/sources/keyboard-mouse-source.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/extras/input/sources/keyboard-mouse-source.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas/src/extras/input/sources/keyboard-mouse-source.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/framework/parsers/texture/ktx.js | matched "\\x1A" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/framework/parsers/texture/ktx2.js | matched "\\x1A" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/extras/mini-stats/mini-stats.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/extras/mini-stats/mini-stats.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas/src/extras/mini-stats/mini-stats.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/scripts/textmesh/opentype.min.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/scripts/spine/playcanvas-spine.3.8.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/core/read-stream.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/core/read-stream.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas/src/core/read-stream.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/core/string.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/core/string.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas/src/core/string.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/build/playcanvas.dbg/src/framework/components/element/text-element.js | matched "\\u200b" | 3 |
| low | Obfuscation | package/build/playcanvas.prf/src/framework/components/element/text-element.js | matched "\\u200b" | 3 |
| low | Obfuscation | package/build/playcanvas/src/framework/components/element/text-element.js | matched "\\u200b" | 3 |
Manifest
Package metadata
Scripts29
buildnode build.mjsbuild:debugnpm run build target:debugbuild:esmnpm run build target:esmbuild:esm:debugnpm run build target:esm:debugbuild:esm:releasenpm run build target:esm:releasebuild:profilernpm run build target:profilerbuild:releasenpm run build target:releasebuild:sourcemapsnpm run build -- -mbuild:treeflamenpm run build target:release treeflamebuild:treemapnpm run build target:release treemapbuild:treenetnpm run build target:release treenetbuild:treesunnpm run build target:release treesunbuild:typesnpm run build target:typesbuild:umdnpm run build target:umddocstypedoclinteslint scripts src test utils build.mjs eslint.config.mjs rollup.config.mjspublintpublint --level errorserveserve build -l 51000 --corstestmocha --ignore "test/assets/scripts/*.js" --recursive --require test/fixtures.mjs --timeout 5000test:coveragec8 npm testtest:typestsc --pretty false build/playcanvas.d.tswatchnpm run build -- -wwatch:debugnpm run build target:debug -- -wwatch:esmnpm run build target:esm -- -wwatch:esm:debugnpm run build target:esm:debug -- -wwatch:esm:releasenpm run build target:esm:release -- -wwatch:profilernpm run build target:profiler -- -wwatch:releasenpm run build target:release -- -wwatch:umdnpm run build target:umd -- -w
Dependencies2
@types/webxr^0.5.24@webgpu/types^0.1.66
Optional dependencies1
canvas3.2.1