PkgRadar

Package evidence

[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
97
First published
Jan 2026
Publisher
filipexyz

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherfilipexyz
Artifact bytes3,123,848
Previous version3.260524.2
Published2026-05-24T12:32:17.675Z
SHA-256f09c156e9f3c5d7d3db465acb6586b6f257566dd126ba0aca1ca42ec1655b90d

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
25Score
3.260524.3Version
Status history (2 events)
  1. available → available · risk review · score 25 · status available -> available, risk high -> review, score 49 -> 25
  2. new → available · risk high · score 49 · status changed

Related candidates

Linked campaigns and clusters

Repeated static TTPstale

Install Lifecycle Suppresses Failure — prepare="git config core.hookspath .githooks 2>/dev/null || true"

10 members · evidence strength 83
Publisher / release actor burststale

filipexyz

3 members · evidence strength 63

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/tui/index.jshigh encoded/escaped-token density12
mediumLarge Javascript Payloadpackage/dist/bundle/index.js2934893 bytes10
Show all 3 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/tui/index.jshigh encoded/escaped-token density12
mediumLarge Javascript Payloadpackage/dist/bundle/index.js2934893 bytes10
lowObfuscationpackage/dist/tui/index.jsmatched "\\x1B"3

Manifest

Package metadata

Scripts32
  • buildbun run build:cli && bun run build:tui && bun run gen:plugins
  • build:clibun build src/cli/index.ts --outdir dist/bundle --target bun --minify --keep-names --sourcemap=linked --external ink --external react --external '@anthropic-ai/*' --external openai --external '@google/*' --external nats --external '@elevenlabs/*'
  • build:tuibun build src/tui/index.tsx --outdir dist/tui --target bun --keep-names --sourcemap=linked --external '@opentui/core' --external '@opentui/react' --external react --external nats
  • check:docsbun run lint:docs && bun run docs:check-links
  • clibun src/cli/index.ts
  • devbun --watch src/index.ts
  • docs:check-linksbun scripts/docs-link-audit.mjs
  • docs:devcd docs && bunx mintlify dev
  • docs:listbun scripts/docs-list.js
  • docs:openapibun src/cli/index.ts sdk openapi emit --out docs/openapi.json
  • gen:commandsbun scripts/gen-commands.ts
  • gen:pluginsbun scripts/gen-plugins.ts
  • lintbunx biome check src/
  • lint:docsbunx markdownlint-cli2 "**/*.{md,mdx}" "#node_modules" "#docs/node_modules"
  • lint:docs:fixbunx markdownlint-cli2 --fix
  • lint:fixbunx biome check --write src/
  • prebuildbun run gen:commands
  • predocs:devbun run docs:openapi
  • prepackbun run build
  • preparegit config core.hooksPath .githooks 2>/dev/null || true
  • rc505:debugswift src/tui/bridges/rc505-bridge.swift --debug-sources
  • reference:contextbun src/reference/context-cli.ts
  • sdk:checkbun src/cli/index.ts sdk client check
  • sdk:generatebun src/cli/index.ts sdk client generate
  • startbun src/index.ts
  • testbun test src/bash/ src/hooks/ src/router/ src/heartbeat/ src/permissions/ src/triggers/ src/omni/ src/plugins/ src/adapters/ src/approval/ src/tui/hooks/runtime-feed.test.ts src/tui/hooks/runtime-display.test.ts src/gateway-typing.test.ts && bun test src/tasks/ src/projects/ src/workflow-substrate/ src/whatsapp-overlay/ && bun run test:cli-commands && bun test src/bot.runtime-guards.test.ts && bun test src/remote-spawn-nats.test.ts && bun test src/runtime/index.test.ts src/runtime/model-catalog.test.ts && bun test src/runtime/context-registry.test.ts && bun test src/cli/context.test.ts src/cli/logging.test.ts src/cli/tui-launcher.test.ts && bun test src/utils/logger.test.ts && bun test src/transcripts.test.ts && bun run test:sdk
  • test:cli-commandsfor f in src/cli/commands/*.test.ts; do bun test "$f" || exit 1; done
  • test:liveRAVI_LIVE_TESTS=1 bun test src/runtime/*.live.test.ts && RAVI_LIVE_TESTS=1 bun test src/bot.live.test.ts
  • test:sdkbun test src/sdk/client-codegen/ ./tests/integration/sdk-roundtrip.test.ts ./packages/ravi-os-sdk/src/__tests__/types.test-d.ts ./packages/ravi-os-sdk/src/__tests__/streaming.test.ts && bun run sdk:check
  • tuibun src/tui/index.tsx
  • …and 2 more.
Dependencies18
  • @anthropic-ai/claude-agent-sdk^0.2.113
  • @elevenlabs/elevenlabs-js^2.37.0
  • @google/genai^1.41.0
  • @hapi/boom^10.0.1
  • @opentui/core^0.1.81
  • @opentui/react^0.1.81
  • agora-agent-server-sdk^1.3.2
  • commander^14.0.2
  • croner^10.0.1
  • ink^6.6.0
  • ink-text-input^6.0.0
  • nats^2.29.3
  • openai^6.17.0
  • pino^9.6.0
  • qrcode-terminal^0.12.0
  • react^19.2.4
  • reflect-metadata^0.2.2
  • zod^4.3.6