npm · registry.npmjs.org
@xwiki/cristal-electron-renderer
Js Decode Then Exec: base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern.
Why PkgRadar flagged 1.4.0-1
| Severity | Signal | Evidence |
|---|---|---|
| high | Js Decode Then Exec | base64 / atob / fromCharCode decode paired with eval / new Function in the same file — canonical obfuscated-loader pattern. · package/dist/index-DJODl9rh.js |
| medium | Large Javascript Payload | 2575611 bytes · package/dist/c-edit-blocknote-SashFMY8.js |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
1.4.0-1 | Review | 27 | 2026-05-28 |
1.3.0 | Review | 5 | 2026-05-28 |
1.4.0 | Low risk | 0 | 2026-05-28 |
Block this in CI
pkgradar gate --ecosystem npm @xwiki/[email protected]