Package evidence

[email protected]

Obfuscation Density: high encoded/escaped-token density

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publisherstevenvelozo

Artifact bytes28,397,545

Previous version1.0.28

Published2026-05-25T00:37:27.187Z

SHA-256ce255238338098e8052684fb60bda2f70e20b092f7a1ff049619e38879431061

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

23d agoLast checked

highRisk

897Score

1.0.29Version

Status history (1 event)

new → available23d ago · risk high · score 897 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

stevenvelozo

6 members · evidence strength 84

Evidence

Static findings

124 static · 0 from release diff · showing high-signal first.

Showing 30 of 59 findings.

Severity	Kind	Path	Detail	Points
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ar-SA-NXDWD63E.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/az-AZ-MXSORGZV.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/bg-BG-O6MV2KSF.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/bn-BD-T2VJNT7N.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/bn-IN-MMW2ORAC.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ca-ES-MKBCGNOG.js	high encoded/escaped-token density	12
medium	Remote Payload	package/html/codejar-bundle.js	matched "wget "	12
medium	Obfuscation Density	package/html/codejar-bundle.js	high encoded/escaped-token density	12
medium	Remote Payload	package/web-application/codejar-bundle.js	matched "wget "	12
medium	Obfuscation Density	package/web-application/codejar-bundle.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/html/codemirror-bundle.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/codemirror-bundle.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/cs-CZ-V77HGUP7.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/de-CH-WLRDEVBV.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/de-DE-DTI4WUSC.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/el-GR-ZXDJ2OS4.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/es-ES-DYQHAD43.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/fa-IR-26LZG4PM.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/fi-FI-6YS4KDE4.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/fr-FR-BRLLPTZC.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/gl-ES-OKUZTLYG.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/he-IL-26MGYIU7.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/hi-IN-Q4ZOGTP2.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/hu-HU-P2OXPSN5.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ja-JP-MAND2Z4V.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/kaa-HQRTCXTJ.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/kab-KAB-JKIKKTGH.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/kk-KZ-HXQ63ZFC.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/km-KH-PKL3LSGX.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ko-KR-KXLREZX3.js	high encoded/escaped-token density	12

Show all 124 findings (low-signal and informational)

Showing 60 of 124 findings.

Severity	Kind	Path	Detail	Points
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ar-SA-NXDWD63E.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/az-AZ-MXSORGZV.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/bg-BG-O6MV2KSF.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/bn-BD-T2VJNT7N.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/bn-IN-MMW2ORAC.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ca-ES-MKBCGNOG.js	high encoded/escaped-token density	12
medium	Remote Payload	package/html/codejar-bundle.js	matched "wget "	12
medium	Obfuscation Density	package/html/codejar-bundle.js	high encoded/escaped-token density	12
medium	Remote Payload	package/web-application/codejar-bundle.js	matched "wget "	12
medium	Obfuscation Density	package/web-application/codejar-bundle.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/html/codemirror-bundle.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/codemirror-bundle.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/cs-CZ-V77HGUP7.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/de-CH-WLRDEVBV.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/de-DE-DTI4WUSC.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/el-GR-ZXDJ2OS4.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/es-ES-DYQHAD43.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/fa-IR-26LZG4PM.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/fi-FI-6YS4KDE4.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/fr-FR-BRLLPTZC.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/gl-ES-OKUZTLYG.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/he-IL-26MGYIU7.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/hi-IN-Q4ZOGTP2.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/hu-HU-P2OXPSN5.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ja-JP-MAND2Z4V.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/kaa-HQRTCXTJ.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/kab-KAB-JKIKKTGH.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/kk-KZ-HXQ63ZFC.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/km-KH-PKL3LSGX.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ko-KR-KXLREZX3.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ku-TR-MJ4IER3X.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/lt-LT-H6WFQ6FJ.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/lv-LV-GOCK6SJW.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/mr-IN-IXVLDMEQ.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/my-MM-YG6MYTTD.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/nb-NO-XGWJISD2.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/nn-NO-EMX5MJX5.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/oc-FR-ROEINTVO.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/pa-IN-ZYN6SUDY.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/pl-PL-6VTG7PHC.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/pt-BR-5YFKRR5G.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/pt-PT-GEIXXZ67.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ro-RO-E2P6TFZI.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ru-RU-YBIIY43T.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/si-LK-673C2CI2.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/sk-SK-CKZHQ4AP.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/sl-SI-557H2GWM.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/sv-SE-XOPKKDWS.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/ta-IN-XBH7DQI3.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/th-TH-TOCWH3R4.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/tr-TR-GXW6CYY5.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/uk-UA-IJKTNUDG.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/vi-VN-MULSGNVB.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/zh-CN-MVX3E32U.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/zh-HK-JNU5RLIE.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/web-application/js/excalidraw-assets/locales/zh-TW-LENVCA6T.js	high encoded/escaped-token density	12
medium	Large Javascript Payload	package/web-application/js/excalidraw-wrapper.min.js	8384036 bytes	10
medium	Large Javascript Payload	package/web-application/retold-content-system.compatible.js	3166447 bytes	10
medium	Large Javascript Payload	package/web-application/retold-content-system.js	3000612 bytes	10
low	Obfuscation	package/web-application/js/excalidraw-assets/locales/ar-SA-NXDWD63E.js	matched "\\u0644"	3

Manifest

Package metadata

Scripts20

brandnode node_modules/pict-section-theme/bin/pict-section-theme-brand.js --manifest ../../../Retold-Modules-Manifest.json --module retold-content-system --favicons web-application/favicons
buildnpx quack build && npx quack copy
build-allnpm run build-codemirror && npm run build-codejar && npm run build
build-codejarnode build/build-codejar-bundle.js
build-codemirrornode build/build-codemirror-bundle.js
postpublishnpx quack release postpublish
postversionnpx quack release postversion
prebuildnpm run brand
prepacknpm run build-all
prepublishOnlynpm test
publish:dockernpx quack release publish --image
release:majornpx quack release major
release:major:imagenpx quack release major --image
release:minornpx quack release minor
release:minor:imagenpx quack release minor --image
release:patchnpx quack release patch
release:patch:imagenpx quack release patch --image
startnode source/cli/ContentSystem-CLI-Run.js serve
testmocha -u tdd -R spec
testsmocha -u tdd -R spec -g

Dependencies20

fable^3.1.75
orator^6.1.2
orator-serviceserver-restify^2.0.11
pict^1.0.372
pict-application^1.0.34
pict-provider^1.0.13
pict-provider-theme^1.0.1
pict-provider-vocabulary^1.0.1
pict-section-code^1.0.11
pict-section-content^1.0.5
pict-section-excalidraw^1.0.0
pict-section-filebrowser^1.0.4
pict-section-inlinedocumentation^1.0.1
pict-section-login^1.0.0
pict-section-markdowneditor^1.0.15
pict-section-modal^1.1.4
pict-section-theme^1.0.6
pict-service-commandlineutility^1.0.19
pict-view^1.0.68
ultravisor-beacon^1.0.1