PkgRadar

Package evidence

[email protected]

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
229
Versions published
6
First published
May 2026
Publisher
tolingcode

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publishertolingcode
Artifact bytes830,274
Previous version1.0.5
Published2026-05-28T11:29:28.947Z
SHA-256a17eab5790ea97d19d677a871a2ad5620231fdb83cc0de61e200c1cd7efbf97f

Why flagged

What the scanner saw

Js Split Join Obfuscation: Array-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
40Score
1.0.7Version
Status history (1 event)
  1. new → available · risk review · score 40 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highJs Split Join Obfuscationpackage/src/ControlUI/dist/assets/index-CkdPfeFI.jsArray-of-single-tokens joined to form a string — used to obscure module names like require(["n","o","de",":","cr","yp","to"].join("")), defeating static require() analysis.40

Manifest

Package metadata

Scripts10
  • gatewaynode bin/tolingclaw.js gateway
  • pkg:buildpkg --config pkg.config.json bin/tolingclaw.js
  • skill:listnode src/skill-manager.js list
  • skill:newnode src/skill-manager.js new
  • startnode src/main.js
  • tool:testnode src/tool-tester.js
  • ui:buildcd src/ControlUI && npm run build
  • ui:devcd src/ControlUI && npm run dev
  • ui:previewcd src/ControlUI && npm run preview
  • webnode bin/tolingclaw.js gateway
Dependencies10
  • @element-plus/icons-vue^2.3.2
  • axios^1.16.1
  • chalk^5.3.0
  • commander^12.1.0
  • element-plus^2.14.0
  • lowdb^7.0.0
  • ora^8.0.0
  • qrcode^1.5.4
  • vue-router^4.6.4
  • xlsx^0.18.5