Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Obfuscation Density: high encoded/escaped-token density
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 589 · status changed
Related candidates
Linked campaigns and clusters
xmorse
2 members · evidence strength 64Evidence
Static findings
70 static · 0 from release diff · showing high-signal first.
Showing 30 of 47 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-622CVMZZ-HFPH543A.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-A6KDKBQN-6VKBSDHV.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-LDKNUCSH-JQEK5723.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-LJWOE5KG-36DNQHCT.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-OQO4BJDD-MRKSLJT5.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-PSV545VO-KUZ52D7F.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-RKOSZRMR-RU72PRCO.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-SLOB5ECO-MYUIT52Z.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-SSHBFVID-JIQZ2OLR.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-TJDTFQF5-A5LBYTX6.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-XMKN2FOD-D5TWBHNT.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-XMKN2FOD-GVCUQL37.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-Y53BJZLK-EUQIV252.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-YCG7BCG4-T3OENDSJ.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-D6RMCRV4-5YYG4HIW.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-D6RMCRV4-XCFIRDL6.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-G73BNA7N-B3OPPZB7.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-O4FG2JPU-MLD5YE77.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-T5XNAHJ3-SBU5UWOY.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-TNC5DMGA-CVBTEZ7G.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-UL4TVQPD-IYLCFU52.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/dist/plugin-mcp-dist/lib/mcp.test.js | matched "curl " | 12 |
| medium | Remote Payload | package/src/plugin-mcp-dist/lib/mcp.test.js | matched "curl " | 12 |
| medium | Remote Payload | package/dist/plugin-mcp-dist/lib/schema.js | matched "curl " | 12 |
| medium | Remote Payload | package/src/plugin-mcp-dist/lib/schema.js | matched "curl " | 12 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-2FSYEIRJ-BBUVVSSM.js | 10160148 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-3CBHXOZP-WWKSUDZN.js | 10028905 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-3GQMHAEU-WSITVUPV.js | 4861200 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-3XKDZJDS-CGWKCHCG.js | 10059100 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-BHSMRPXK-IHHGYJRR.js | 10195206 bytes | 10 |
Show all 70 findings (low-signal and informational)
Showing 60 of 70 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-622CVMZZ-HFPH543A.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-A6KDKBQN-6VKBSDHV.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-LDKNUCSH-JQEK5723.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-LJWOE5KG-36DNQHCT.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-OQO4BJDD-MRKSLJT5.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-PSV545VO-KUZ52D7F.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-RKOSZRMR-RU72PRCO.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-SLOB5ECO-MYUIT52Z.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-SSHBFVID-JIQZ2OLR.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-TJDTFQF5-A5LBYTX6.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-XMKN2FOD-D5TWBHNT.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-XMKN2FOD-GVCUQL37.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-Y53BJZLK-EUQIV252.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/fontshare-YCG7BCG4-T3OENDSJ.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-D6RMCRV4-5YYG4HIW.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-D6RMCRV4-XCFIRDL6.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-G73BNA7N-B3OPPZB7.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-O4FG2JPU-MLD5YE77.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-T5XNAHJ3-SBU5UWOY.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-TNC5DMGA-CVBTEZ7G.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/framer-chunks/framer-font-UL4TVQPD-IYLCFU52.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/dist/plugin-mcp-dist/lib/mcp.test.js | matched "curl " | 12 |
| medium | Remote Payload | package/src/plugin-mcp-dist/lib/mcp.test.js | matched "curl " | 12 |
| medium | Remote Payload | package/dist/plugin-mcp-dist/lib/schema.js | matched "curl " | 12 |
| medium | Remote Payload | package/src/plugin-mcp-dist/lib/schema.js | matched "curl " | 12 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-2FSYEIRJ-BBUVVSSM.js | 10160148 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-3CBHXOZP-WWKSUDZN.js | 10028905 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-3GQMHAEU-WSITVUPV.js | 4861200 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-3XKDZJDS-CGWKCHCG.js | 10059100 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-BHSMRPXK-IHHGYJRR.js | 10195206 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-EJBUPU3N-JOFVHSFQ.js | 10076981 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-EJBUPU3N-LSIK52DF.js | 10076981 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-FDB6LUFQ-PFSUZGKF.js | 5261954 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-FXMGJG4N-3YVGUBYO.js | 4861200 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-HHQRBNOM-DLREIKWB.js | 10186167 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-HSMCYMMG-DWNQGSHN.js | 5272673 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-IHP45ZLM-ZVSA7AH6.js | 10060368 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-IP4ZFBZ6-BPKEAUY3.js | 10033378 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-JQDPZLQE-ZY6DPNHB.js | 10076981 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-KTMKGB4J-RA7CAZTC.js | 5272673 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-MX3N35K3-NSXXLNAK.js | 9978704 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-RSE7HKS2-D4J2Q4I5.js | 5361728 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-SWLQ2TQI-KVBTY6BO.js | 4861200 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-TRAPONMP-UUEFJ4ZF.js | 10076981 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-UXOX5SHT-L6YCUBAJ.js | 10012659 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-XJDPWDTU-EJ2YKDXG.js | 5362332 bytes | 10 |
| medium | Large Javascript Payload | package/dist/framer-chunks/google-YUHGDXQ4-5ORV5F75.js | 10186215 bytes | 10 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-622CVMZZ-HFPH543A.js | matched "\\u011E" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-A6KDKBQN-6VKBSDHV.js | matched "\\xDF" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-LDKNUCSH-JQEK5723.js | matched "\\xA8" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-LJWOE5KG-36DNQHCT.js | matched "\\xA1" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-OQO4BJDD-MRKSLJT5.js | matched "\\xA1" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-PSV545VO-KUZ52D7F.js | matched "\\xA8" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-RKOSZRMR-RU72PRCO.js | matched "\\xA1" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-SLOB5ECO-MYUIT52Z.js | matched "\\xB6" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-SSHBFVID-JIQZ2OLR.js | matched "\\u015E" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-TJDTFQF5-A5LBYTX6.js | matched "\\xA8" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-XMKN2FOD-D5TWBHNT.js | matched "\\xA1" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-XMKN2FOD-GVCUQL37.js | matched "\\xA1" | 3 |
| low | Obfuscation | package/dist/framer-chunks/fontshare-Y53BJZLK-EUQIV252.js | matched "\\xA1" | 3 |
Manifest
Package metadata
Scripts5
buildrm -rf dist && pnpm tsgo && cp ../README.md ./README.md && cp ./src/framer.d.ts ./dist/framer.d.ts && cp ./src/framer.js ./dist/framer.js && cp -r ./src/framer-chunks ./dist/framer-chunksdownload-framertsx scripts/download.tsgen-clientexport DIR=./src/generated/ && cd ../../website && pnpm tsc; rm -rf $DIR && mkdir -p $DIR && cp ./dist/src/lib/api-client.* $DIRtestvitestwatchrm -rf dist && pnpm tsc -w
Dependencies24
@antfu/ni^25.0.0@babel/core^7.28.6@biomejs/js-api^0.7.1@biomejs/wasm-nodejs^1.9.4@goke/mcp^0.0.4@inquirer/prompts^8.2.0@modelcontextprotocol/sdk^1.25.3async-sema^3.1.1camelcase^9.0.0diff^7.0.0dom-serializer^2.0.0esbuild^0.25.8esbuild-plugins-node-modules-polyfill^1.6.8framer-api^0.1.2goke^6.8.0htmlparser2^10.1.0nanospinner^1.2.2picocolors^1.1.1real-framer-motionnpm:framer-motion@^12.34.2sema4^0.1.3spiceflow^1.17.10string-dedent^3.0.1undici^7.18.2zod^4.3.6