All flagged patterns are benign. is.generated.js and scanner.js contain normal auto-generated AST predicates and large static unicode tables. client.js legitimately spawns the package's own tsgo binary (via child_process) and decodes base64 binary responses over its JSON-RPC protocol; no exfiltration, backdoors or hidden execution.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Package named typescript version 7.0.2 claims to provide the TypeScript language for application-scale JavaScript development and exposes a tsc binary with supporting dist, lib, and vendor files.
Capabilities
- Provides tsc command-line binary
- Includes numerous compiled JS modules in dist/api, dist/ast, and lib/
- Bundles vendor code such as vscode-jsonrpc
- Declares no dependencies
Data access
- Filesystem
Network
- No network access observed
Static findings report version metadata mismatch, multiple obfuscated source files, and decoded payload execution, which contrast with the package's stated purpose and warrant review prior to use.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (7)
Static analysis rule matches, with the exact code that triggered them.
Version mismatch in vendor/vscode-jsonrpc/package.json
Multiple obfuscation patterns in dist/ast/is.generated.js
Multiple obfuscation patterns in package/dist/ast/is.generated.js
Multiple obfuscation patterns in dist/ast/scanner.js
Multiple obfuscation patterns in package/dist/ast/scanner.js
File dist/api/async/client.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File package/dist/api/async/client.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
Package metadata
TypeScript is a language for application scale JavaScript development
Files in package (500)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/typescript