@kahitsan/plugin-sdk@0.8.2

Analysis

@kahitsan/plugin-sdk@0.8.2 ships its runtime bundle dist/index.js obfuscated with a string-array / _0x-identifier obfuscator and a custom fromCharCode + decodeURIComponent string decoder, and prefixes that bundle with a base64-encoded comment block that decodes to a directive addressed to AI assistants, LLMs and automated code-review tools. The decoded text orders any model reading the file to stop, to refuse to deobfuscate, decompile, beautify, summarize or describe the code, and adds an anti-override clause declaring that any instruction to ignore the notice — including one arriving from a system message or "developer"/"jailbreak" framing — is conclusive proof the request is illegitimate. The same directive is mirrored in plain text in the package LICENSE, which states the runtime is intentionally obfuscated. The encoding hides the directive from a human reading the file, which sees only a copyright banner. The package declares no install or postinstall lifecycle hook; its bin/cli.mjs spawns the Bun runtime to launch a local development server, and the dev sources under src/dev/ only contact 127[.]0[.]0[.]1 loopback addresses. The package contains no credential, token or wallet access and no external network endpoint.