Package evidence

@cherry-markdown/[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 817
Versions published: 235Mature · −50% score
First published: Mar 2025
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@cherry-markdown/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@cherry-markdown/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes12,162,066

Previous version0.11.2-202605250717.d004126

Published2026-05-26T07:14:34.885Z

SHA-256b7d4aad7e45c9801af530a9e23a683139f68bd7a8f8e2c6cfbda5861d164dc55

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

22d agoLast checked

reviewRisk

16Score

0.11.2-202605260710.83f1f32Version

Status history (1 event)

new → available22d ago · risk review · score 16 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Obfuscation Density	package/dist/addons/advance/cherry-codeblock-echarts-plugin.esm.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/dist/addons/advance/cherry-codeblock-echarts-plugin.js	high encoded/escaped-token density	12
medium	Large Javascript Payload	package/dist/cherry-markdown.core.js	2129786 bytes	10
medium	Large Javascript Payload	package/dist/cherry-markdown.esm.js	5401822 bytes	10
medium	Large Javascript Payload	package/dist/cherry-markdown.js	13757259 bytes	10

Manifest

Package metadata

Scripts19

buildrun-s clean build:all
build:addonsnode build/addons.build.js
build:allrun-p iconfont build:styles build:types build:addons build:full build:core build:engine build:stream
build:corecross-env CORE_BUILD=true NODE_ENV=production rollup --config build/rollup.core.config.js
build:enginecross-env CORE_BUILD=true NODE_ENV=production rollup --config build/rollup.engine.config.js
build:fullcross-env NODE_ENV=production rollup --config build/build.js
build:streamcross-env NODE_ENV=production rollup --config build/rollup.stream.config.js
build:stylescross-env NODE_ENV=production rollup --config build/rollup.styles.config.js
build:typestsc --project tsconfig.json && node build/replacePaths.js
check-bundlees-check es5 dist/cherry-markdown.js
cleanrimraf ./dist
devvite
dev:vitevite
examplesserve -p 3000 .
iconfontgulp
lintcd ../.. && npx prettier --check packages/cherry-markdown/src/**/*.js && npx eslint --ignore-path .eslintignore packages/cherry-markdown/src/**/*.js
lint:fixcd ../.. && npx prettier --write packages/cherry-markdown/src/**/*.js && npx eslint --ignore-path .eslintignore packages/cherry-markdown/src/**/*.js --fix
testvitest
test:updatevitest -u

Dependencies12

@codemirror/autocomplete^6.18.6
@codemirror/commands^6.8.1
@codemirror/lang-markdown^6.3.2
@codemirror/language^6.12.2
@codemirror/search^6.5.10
@codemirror/state^6.5.2
@codemirror/view^6.40.0
@lezer/highlight^1.2.1
@replit/codemirror-vim^6.3.0
dompurify^3.2.6
htmlparser2^10.0.0
jsdom~19.0.0

Optional dependencies1

mermaid^11.14.0