Package evidence
@bitcode-framework/[email protected]
Obfuscation Density: high encoded/escaped-token density
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Versions published
- 1
- First published
- May 2026
- Publisher
- brainplusplus
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@bitcode-framework/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@bitcode-framework/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Obfuscation Density: high encoded/escaped-token density
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 136 · status changed
Evidence
Static findings
194 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/dist/cjs/bc-field-markdown.cjs.entry.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/esm/bc-field-markdown.entry.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/dist/components/widgets/index.js | matched "cUrl " | 12 |
Show all 194 findings (low-signal and informational)
Showing 60 of 194 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/dist/cjs/bc-field-markdown.cjs.entry.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/esm/bc-field-markdown.entry.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/dist/components/widgets/index.js | matched "cUrl " | 12 |
| low | Obfuscation | package/dist/cjs/bc-activity.cjs.entry.js | matched "\\u260E" | 3 |
| low | Obfuscation | package/dist/esm/bc-activity.entry.js | matched "\\u260E" | 3 |
| low | Obfuscation | package/dist/collection/components/social/bc-activity/bc-activity.js | matched "\\u260E" | 3 |
| low | Obfuscation | package/dist/cjs/bc-chart-kpi.cjs.entry.js | matched "\\u25B2" | 3 |
| low | Obfuscation | package/dist/esm/bc-chart-kpi.entry.js | matched "\\u25B2" | 3 |
| low | Obfuscation | package/dist/collection/components/charts/bc-chart-kpi/bc-chart-kpi.js | matched "\\u25B2" | 3 |
| low | Obfuscation | package/dist/cjs/bc-child-table.cjs.entry.js | matched "\\u25B2" | 3 |
| low | Obfuscation | package/dist/esm/bc-child-table.entry.js | matched "\\u25B2" | 3 |
| low | Obfuscation | package/dist/collection/components/datatable/bc-child-table/bc-child-table.js | matched "\\u25B2" | 3 |
| low | Obfuscation | package/dist/cjs/bc-copy.cjs.entry.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/esm/bc-copy.entry.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/collection/components/widgets/bc-copy/bc-copy.js | matched "\\u2713" | 3 |
| low | Obfuscation | package/dist/cjs/bc-datatable.cjs.entry.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/esm/bc-datatable.entry.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/collection/components/datatable/bc-datatable/bc-datatable.js | matched "\\u25B2" | 3 |
| low | Obfuscation | package/dist/components/bc-datatable.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/cjs/bc-dialog-alert.cjs.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/esm/bc-dialog-alert.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/collection/components/dialogs/bc-dialog-alert/bc-dialog-alert.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/cjs/bc-dialog-confirm.cjs.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/esm/bc-dialog-confirm.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/collection/components/dialogs/bc-dialog-confirm/bc-dialog-confirm.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/cjs/bc-dialog-modal_3.cjs.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/esm/bc-dialog-modal_3.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/collection/components/dialogs/bc-dialog-modal/bc-dialog-modal.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/cjs/bc-dialog-prompt.cjs.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/esm/bc-dialog-prompt.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/collection/components/dialogs/bc-dialog-prompt/bc-dialog-prompt.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/cjs/bc-dialog-quickentry.cjs.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/esm/bc-dialog-quickentry.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/collection/components/dialogs/bc-dialog-quickentry/bc-dialog-quickentry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/cjs/bc-dialog-wizard.cjs.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/esm/bc-dialog-wizard.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/collection/components/dialogs/bc-dialog-wizard/bc-dialog-wizard.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/cjs/bc-favorites.cjs.entry.js | matched "\\u2606" | 3 |
| low | Obfuscation | package/dist/esm/bc-favorites.entry.js | matched "\\u2606" | 3 |
| low | Obfuscation | package/dist/collection/components/search/bc-favorites/bc-favorites.js | matched "\\u2606" | 3 |
| low | Obfuscation | package/dist/cjs/bc-field-barcode.cjs.entry.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/esm/bc-field-barcode.entry.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/collection/components/fields/bc-field-barcode/bc-field-barcode.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/components/bc-field-barcode.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist/cjs/bc-field-code.cjs.entry.js | matched "\\xa1" | 3 |
| low | Obfuscation | package/dist/esm/bc-field-code.entry.js | matched "\\xa1" | 3 |
| low | Obfuscation | package/dist/collection/components/fields/bc-field-code/bc-field-code.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/components/bc-field-code.js | matched "\\xa1" | 3 |
| low | Obfuscation | package/dist/cjs/bc-field-color.cjs.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/esm/bc-field-color.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/collection/components/fields/bc-field-color/bc-field-color.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/cjs/bc-field-currency.cjs.entry.js | matched "\\u20AC" | 3 |
| low | Obfuscation | package/dist/esm/bc-field-currency.entry.js | matched "\\u20AC" | 3 |
| low | Obfuscation | package/dist/collection/components/fields/bc-field-currency/bc-field-currency.js | matched "\\u20AC" | 3 |
| low | Obfuscation | package/dist/cjs/bc-field-date.cjs.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/esm/bc-field-date.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/collection/components/fields/bc-field-date/bc-field-date.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/cjs/bc-field-datetime.cjs.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/esm/bc-field-datetime.entry.js | matched "\\u00D7" | 3 |
| low | Obfuscation | package/dist/collection/components/fields/bc-field-datetime/bc-field-datetime.js | matched "\\u00D7" | 3 |
Manifest
Package metadata
Scripts11
buildstencil build && node scripts/generate-exports.mjs && node src/demo/build-demo.jsbuild:demonode src/demo/build-demo.jsbuild:stencilstencil builddemonode scripts/kill-demo.js && stencil build && node src/demo/build-demo.js && npx -y http-server www -p 3333 -c-1 --cors -o /demo/demo:killnode scripts/kill-demo.jsgeneratestencil generategenerate:exportsnode scripts/generate-exports.mjsstartstencil build --dev --watch --serveteststencil test --spectest:e2estencil test --e2etest:watchstencil test --spec --watchAll
Dependencies25
@codemirror/lang-css^6.3.1@codemirror/lang-html^6.4.11@codemirror/lang-javascript^6.2.5@codemirror/lang-json^6.0.2@codemirror/lang-python^6.2.1@codemirror/lang-sql^6.10.0@codemirror/lang-xml^6.1.0@codemirror/state^6.6.0@codemirror/view^6.41.0@fullcalendar/core^6.1.20@fullcalendar/daygrid^6.1.20@fullcalendar/interaction^6.1.20@stencil/store^2.2.2@tiptap/core^3.22.3@tiptap/extension-placeholder^3.22.3@tiptap/starter-kit^3.22.3codemirror^6.0.2echarts^6.0.0jsbarcode^3.12.3leaflet^1.9.4markdown-it^14.1.1qrcode^1.5.4signature_pad^5.1.3sortablejs^1.15.7xlsx^0.18.5