Package evidence
@cangjielang/[email protected]
Obfuscation Density: high encoded/escaped-token density
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 2,245Niche · −30% score
- Versions published
- 29
- First published
- May 2026
- Publisher
- ousc
Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@cangjielang/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@cangjielang/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Obfuscation Density: high encoded/escaped-token density
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (2 events)
- available → available · risk review · score 161 · status available -> available, risk high -> review, score 1509 -> 161
- new → available · risk high · score 1509 · status changed
Evidence
Static findings
316 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/.next/server/chunks/ssr/_eba1ff4d._.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/.next/static/chunks/03b2bc163081e892.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/.next/static/chunks/0bd41f0cb6103de0.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/.next/static/chunks/575a6057f2824e16.js | matched "curl " | 12 |
| medium | Obfuscation Density | package/.next/static/chunks/e13f11148ad77436.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/.next/static/chunks/fea6682ebdf786e0.js | matched "curl " | 12 |
| medium | Obfuscation Density | package/.next/server/chunks/ssr/node_modules_mermaid_dist_chunks_mermaid_core_chunk-4TB4RGXK_mjs_6ad0b29a._.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/.next/server/chunks/ssr/node_modules_mermaid_dist_chunks_mermaid_core_flowDiagram-DWJPFMVM_mjs_f3a7d7e1._.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/.next/server/chunks/ssr/src_app_account_channels_page_tsx_3929d9bd._.js | matched "curl " | 12 |
| medium | Remote Payload | package/.next/server/chunks/ssr/src_app_api-docs_page_tsx_7af92e08._.js | matched "curl " | 12 |
| medium | Remote Payload | package/.next/server/chunks/ssr/src_app_engines_page_tsx_8cee74ce._.js | matched "curl " | 12 |
| medium | Large Javascript Payload | package/.next/static/chunks/0ac0bedebff63a59.js | 3379064 bytes | 10 |
| medium | Large Javascript Payload | package/.next/static/chunks/66e82fb7fe171287.js | 6665242 bytes | 10 |
Show all 316 findings (low-signal and informational)
Showing 60 of 316 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/.next/server/chunks/ssr/_eba1ff4d._.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/.next/static/chunks/03b2bc163081e892.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/.next/static/chunks/0bd41f0cb6103de0.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/.next/static/chunks/575a6057f2824e16.js | matched "curl " | 12 |
| medium | Obfuscation Density | package/.next/static/chunks/e13f11148ad77436.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/.next/static/chunks/fea6682ebdf786e0.js | matched "curl " | 12 |
| medium | Obfuscation Density | package/.next/server/chunks/ssr/node_modules_mermaid_dist_chunks_mermaid_core_chunk-4TB4RGXK_mjs_6ad0b29a._.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/.next/server/chunks/ssr/node_modules_mermaid_dist_chunks_mermaid_core_flowDiagram-DWJPFMVM_mjs_f3a7d7e1._.js | high encoded/escaped-token density | 12 |
| medium | Remote Payload | package/.next/server/chunks/ssr/src_app_account_channels_page_tsx_3929d9bd._.js | matched "curl " | 12 |
| medium | Remote Payload | package/.next/server/chunks/ssr/src_app_api-docs_page_tsx_7af92e08._.js | matched "curl " | 12 |
| medium | Remote Payload | package/.next/server/chunks/ssr/src_app_engines_page_tsx_8cee74ce._.js | matched "curl " | 12 |
| medium | Large Javascript Payload | package/.next/static/chunks/0ac0bedebff63a59.js | 3379064 bytes | 10 |
| medium | Large Javascript Payload | package/.next/static/chunks/66e82fb7fe171287.js | 6665242 bytes | 10 |
| low | Credential file access | package/.next/static/chunks/0eac975ccdf70b0a.js | matched ".ssh" | 5 |
| low | Credential file access | package/.next/static/chunks/da55416a699642f3.js | matched ".ssh" | 5 |
| low | Obfuscation | package/.next/server/chunks/_00ad0baf._.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/.next/server/chunks/_05bfdf43._.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_06d17dc1._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_1117d82b._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/_1bd600e0._.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_29c032b7._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_43f61e07._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/_4b122fca._.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_5925a59a._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_5cd491f5._.js | matched "\\x00" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_60f85be8._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_69cc75a6._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/_6bd0294c._.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_7722c89d._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_78f9f8d1._.js | matched "\\x00" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_78fcbfcc._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/_8043a737._.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_83c34729._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_8a5c2b33._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_943439f3._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/_96c367e7._.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_97dcd4e6._.js | matched "\\u2028" | 3 |
| low | Obfuscation | package/.next/server/chunks/_9b0ef33f._.js | matched "\\x00" | 3 |
| low | Obfuscation | package/.next/server/chunks/_a99c83c4._.js | matched "\\u4e00" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_acee14e1._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/_cd3cae6b._.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_dbd40f1b._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_de4fe0a7._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_e4269c0f._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_e68ece59._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/_eba1ff4d._.js | matched "\\x3c" | 3 |
| low | Obfuscation | package/.next/server/chunks/_f505ed90._.js | matched "\\x00" | 3 |
| low | Obfuscation | package/.next/server/chunks/[root-of-the-server]__00274b5b._.js | matched "\\u4e00" | 3 |
| low | Obfuscation | package/.next/server/chunks/[root-of-the-server]__00c6a178._.js | matched "\\u0000" | 3 |
| low | Obfuscation | package/.next/server/chunks/[root-of-the-server]__064dd08e._.js | matched "\\u0000" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/[root-of-the-server]__088b3fd0._.js | matched "\\u0000" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/[root-of-the-server]__158a47e9._.js | matched "\\xb7" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/[root-of-the-server]__1b921019._.js | matched "\\x20" | 3 |
| low | Obfuscation | package/.next/server/chunks/[root-of-the-server]__1f1bd2dd._.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/.next/server/chunks/[root-of-the-server]__3026ce34._.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/.next/server/chunks/ssr/[root-of-the-server]__3fb74832._.js | matched "\\u0000" | 3 |
| low | Obfuscation | package/.next/server/chunks/[root-of-the-server]__4164ab32._.js | matched "\\u4e00" | 3 |
| low | Obfuscation | package/.next/server/chunks/[root-of-the-server]__4a5d6a90._.js | matched "\\u4e00" | 3 |
| low | Obfuscation | package/.next/server/chunks/[root-of-the-server]__503ad694._.js | matched "\\u4e00" | 3 |
| low | Obfuscation | package/.next/server/chunks/[root-of-the-server]__564bf5b1._.js | matched "\\u0000" | 3 |
Manifest
Package metadata
Scripts26
acenode ./bin/ace.jsbuildnpm run build:cli && next buildbuild:clinode scripts/build-cli.jscheck:acpnode ./scripts/check-acp-connectivity.mjscheck:batch-reportnode ./scripts/check-batch-report.cjscheck:clarification-qanode ./scripts/check-clarification-qa.cjscheck:engine-chatnode ./scripts/check-engine-chat.cjscheck:enginesnode ./scripts/check-engine-availability.mjscheck:spec-codingnode ./scripts/check-spec-coding.cjscheck:spec-then-workflownode ./scripts/check-spec-then-workflow.cjscheck:workflow-creatornode ./scripts/check-workflow-creator.cjscleannode -e "const fs=require('fs'); for (const p of ['dist','.next','dist-build']) fs.rmSync(p,{recursive:true,force:true});"devnpm run build:cli && node server.js devlinteslint . --cachelint:fixeslint . --cache --fixprepacknpm run build && npm run prune:package-mapspreparenode scripts/build-cli.jsprune:package-mapsnode scripts/prune-package-maps.jspublish:betanpm run build && npm publish --tag betapublish:npmnpm run build && npm publishstartnode server.js starttestvitest runtest:componentsvitest run tests/components --environment jsdomwechat:officialnode -r ts-node/register -r tsconfig-paths/register scripts/wechat-official.tswechat:qr-testnode scripts/wechat-qr-test-runner.mjswechat:relaynode scripts/wechat-bridge-relay.mjs
Dependencies112
@agentclientprotocol/claude-agent-acp0.36.1@agentclientprotocol/sdk0.22.1@anthropic-ai/claude-agent-sdk0.3.146@anthropic-ai/sdk^0.97.1@aws-sdk/client-s3^3.1049.0@base-ui/react^1.3.0@dnd-kit/core^6.3.1@dnd-kit/sortable^10.0.0@dnd-kit/utilities^3.2.2@hookform/resolvers^3.3.0@modelcontextprotocol/sdk^1.29.0@monaco-editor/react^4.7.0@openai/codex-sdk0.130.0@opencode-ai/sdk^1.14.50@radix-ui/react-alert-dialog^1.1.15@radix-ui/react-checkbox^1.3.3@radix-ui/react-collapsible^1.1.12@radix-ui/react-context-menu^2.2.16@radix-ui/react-dialog^1.1.15@radix-ui/react-dropdown-menu^2.1.16@radix-ui/react-hover-card^1.1.15@radix-ui/react-label^2.1.8@radix-ui/react-progress^1.1.8@radix-ui/react-scroll-area^1.2.10@radix-ui/react-select^2.2.6@radix-ui/react-separator^1.1.8@radix-ui/react-slot^1.2.4@radix-ui/react-switch^1.2.6@radix-ui/react-tabs^1.1.13@radix-ui/react-tooltip^1.2.8- …and 82 more.
Optional dependencies8
@anthropic-ai/claude-agent-sdk-darwin-arm640.3.146@anthropic-ai/claude-agent-sdk-darwin-x640.3.146@anthropic-ai/claude-agent-sdk-linux-arm640.3.146@anthropic-ai/claude-agent-sdk-linux-arm64-musl0.3.146@anthropic-ai/claude-agent-sdk-linux-x640.3.146@anthropic-ai/claude-agent-sdk-linux-x64-musl0.3.146@anthropic-ai/claude-agent-sdk-win32-arm640.3.146@anthropic-ai/claude-agent-sdk-win32-x640.3.146