npm · registry.npmjs.org

crossnote

Obfuscation Density: high encoded/escaped-token density

Why PkgRadar flagged 0.9.28

Severity	Signal	Evidence
medium	Obfuscation Density	high encoded/escaped-token density · package/out/dependencies/vega/vega.min.js
medium	Large Javascript Payload	3312967 bytes · package/out/dependencies/mermaid/mermaid.min.js
medium	Large Javascript Payload	4199544 bytes · package/out/webview/preview.js

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.9.28`	Review	20	2026-05-24
`0.9.27`	Review	20	2026-05-24
`0.9.25`	Review	20	2026-05-24
`0.9.26`	Review	20	2026-05-24

Block this in CI

PkgRadar gates crossnote (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]