Package evidence

[email protected]

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 27,277Mainstream · −50% score
Versions published: 456Mature · −50% score
First published: Jul 2012
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes4,965,946

Previous version1.1.111

Published2026-05-30T06:29:09.539Z

SHA-25697081a5eff355f8404f96cd69ada8619961da6ece38402d496cddf9183aae987

Why flagged

What the scanner saw

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

18d agoLast checked

reviewRisk

16Score

1.1.112Version

Status history (1 event)

new → available18d ago · risk review · score 16 · status changed

Evidence

Static findings

13 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Js Split Join Obfuscation	package/external/@socketsecurity/registry/external/@npmcli/package-json/index.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40
high	Js Split Join Obfuscation	package/external/@socketsecurity/registry/external/@npmcli/promise-spawn.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40
high	Js Split Join Obfuscation	package/external/@socketsecurity/registry/external/which.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40

Show all 13 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Js Split Join Obfuscation	package/external/@socketsecurity/registry/external/@npmcli/package-json/index.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40
high	Js Split Join Obfuscation	package/external/@socketsecurity/registry/external/@npmcli/promise-spawn.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40
high	Js Split Join Obfuscation	package/external/@socketsecurity/registry/external/which.js	Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.	40
low	Credential file access	package/external/@socketsecurity/registry/lib/globs.js	matched ".npmrc"	5
low	Obfuscation Density	package/external/@socketsecurity/registry/external/@inquirer/confirm.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/external/@socketsecurity/registry/external/@inquirer/input.js	high encoded/escaped-token density	0
low	Large Javascript Payload	package/external/@socketsecurity/registry/external/libnpmpack.js	3408939 bytes	0
low	Large Javascript Payload	package/external/@socketsecurity/registry/external/pacote.js	2363104 bytes	0
low	Obfuscation Density	package/external/@socketsecurity/registry/external/@inquirer/password.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/external/@socketsecurity/registry/external/@inquirer/search.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/external/@socketsecurity/registry/external/@inquirer/select.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/external/blessed/lib/unicode.js	high encoded/escaped-token density	0
low	Large Javascript Payload	package/dist/vendor.js	5213726 bytes	0

Manifest

Package metadata

Scripts52

//lint:dist:fix:eslintdotenvx -q run -f .env.dist -- eslint --report-unused-disable-directives --quiet --fix ./dist | dev-null
//lint:external:fix:eslintdotenvx -q run -f .env.external -- eslint --report-unused-disable-directives --quiet --fix ./external | dev-null
bsdotenvx -q run -f .env.local -- pnpm build:dist:src; pnpm exec socket --
buildpnpm build:dist
build:distpnpm build:dist:src && pnpm build:dist:types
build:dist:srcrun-p -c clean:dist clean:external && dotenvx -q run -f .env.local -- rollup -c .config/rollup.dist.config.mjs
build:dist:typespnpm clean:dist:types && tsgo --project tsconfig.dts.json
build:seanode src/sea/build-sea.mts
build:sea:internal:bootstraprollup -c .config/rollup.sea.config.mjs
checkpnpm check:lint && pnpm check:tsc
check-cipnpm check:lint
check:lintdotenvx -q run -f .env.local -- eslint --report-unused-disable-directives .
check:tsctsgo
cleanrun-p -c --aggregate-output clean:*
clean:cachedel-cli '**/.cache'
clean:distdel-cli 'dist'
clean:dist:typesdel-cli 'dist/types'
clean:externaldel-cli 'external'
clean:node_modulesdel-cli '**/node_modules'
coveragerun-s coverage:*
coverage:testrun-s test:prepare test:unit:coverage
coverage:typedotenvx -q run -f .env.local -- type-coverage --detail
e2e-testsdotenvx -q run -f .env.test -- vitest run --config vitest.e2e.config.mts
fixpnpm lint:fix
knip:dependenciesknip --dependencies
knip:exportsknip --include exports,duplicates
lintdotenvx -q run -f .env.local -- oxlint -c=.oxlintrc.json --ignore-path=.oxlintignore --tsconfig=tsconfig.json .
lint-stageddotenvx -q run -f .env.local -- lint-staged
lint:dist:fixrun-s -c lint:dist:fix:*
lint:dist:fix:biomedotenvx -q run -f .env.dist -- biome format --log-level=none --fix ./dist | dev-null
…and 22 more.

Dependencies1

@socketsecurity/socket-patch2.0.0