PkgRadar

npm · registry.npmjs.org

@tarojs/components

Obfuscation Density: high encoded/escaped-token density

Why PkgRadar flagged 4.2.1-beta.1

SeveritySignalEvidence
mediumObfuscation Densityhigh encoded/escaped-token density · package/dist/collection/components/movable-area/movable-view.js
mediumObfuscation Densityhigh encoded/escaped-token density · package/dist/collection/components/video/video.js

Scanned versions

VersionVerdictScoreScanned (UTC)
4.1.12-beta.57Low risk02026-06-17
4.1.12-beta.56Low risk02026-06-16
4.1.12-beta.55Low risk02026-06-16
4.1.12-beta.54Low risk02026-06-16
4.1.12-beta.53Low risk02026-06-16
3.6.1-alpha.0Low risk02026-06-11
3.6.1-alpha.1Low risk02026-06-11
3.6.1-alpha.2Low risk02026-06-11
4.2.0Low risk02026-06-11
4.1.12-beta.52Low risk02026-06-11
4.1.12-beta.51Low risk02026-06-09
4.1.12-beta.50Low risk02026-06-09
4.1.12-beta.47Low risk02026-06-08
4.2.1-beta.1Review122026-05-26
4.1.12-beta.49Review242026-05-25
4.2.1-beta.0Review242026-05-25

Block this in CI

PkgRadar gates @tarojs/components (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @tarojs/[email protected]