PkgRadar

Package evidence

@jackuait/[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
236
Versions published
113Established · −30% score
First published
Nov 2025
Publisher
jackuait

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Looks clean — keep monitoring

No high-signal indicators in the stored static report. PkgRadar will re-check on the next ingest pass.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@jackuait/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@jackuait/[email protected]"],"fail_on":"review"}'
Publisherjackuait
Artifact bytes14,172,138
Previous version0.13.0
Published2026-05-29T10:22:31.294Z
SHA-256ee8b939ac26365dbda93bb029478bdb08973a18b5d6affe523d7a5ed209b2394

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

low
Last checked
lowRisk
0Score
0.13.1Version
Status history (2 events)
  1. new → available · risk low · score 0 · status changed
  2. new → available · risk low · score 0 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 4 findings (low-signal and informational)
SeverityKindPathDetailPoints
lowObfuscation Densitypackage/dist/chunks/chunk-4TB4RGXK-5kwdIl92.cjshigh encoded/escaped-token density0
lowObfuscation Densitypackage/dist/chunks/flowDiagram-DWJPFMVM-BMFUyvhc.cjshigh encoded/escaped-token density0
lowLarge Javascript Payloadpackage/dist/blok.iife.js2489263 bytes0
lowObfuscation Densitypackage/dist/chunks/chunk-4TB4RGXK-DojaY0eu.mjshigh encoded/escaped-token density0

Manifest

Package metadata

Scripts42
  • buildnode scripts/generate-fonts.mjs && vite build --mode production && vite build --config vite.config.iife.mjs --mode production && node scripts/build-locales.mjs
  • build:clinode scripts/build-cli.mjs
  • build:testnode scripts/generate-fonts.mjs && vite build --mode test && vite build --config vite.config.iife.mjs --mode test && node scripts/build-locales.mjs test && node scripts/build-react-vendor.mjs
  • chromaticchromatic --exit-zero-on-changes
  • ci:timingnode scripts/ci-timing-probe.mjs
  • e2eyarn build:test && playwright test
  • e2e:chromeyarn build:test && playwright test --project=chromium
  • e2e:firefoxyarn build:test && playwright test --project=firefox
  • e2e:safariyarn build:test && playwright test --project=webkit
  • e2e:smokeyarn build:test && playwright test --project=chromium --grep="@smoke"
  • e2e:uiyarn build:test && playwright test --ui
  • e2e:ui:chromeyarn build:test && playwright test --ui --project=chromium
  • e2e:ui:firefoxyarn build:test && playwright test --ui --project=firefox
  • e2e:ui:safariyarn build:test && playwright test --ui --project=webkit
  • e2e:validate-categoriesnode scripts/validate-test-categories.mjs
  • i18n:auditnode scripts/i18n-audit.js
  • i18n:checknode scripts/i18n/check-translations.mjs
  • i18n:check:docsnode scripts/i18n/check-docs-translations.mjs
  • jscpdjscpd src/ test/
  • jscpd:reportjscpd . --reporters html,json --output .jscpd-report
  • lintsh -c 'eslint .; ESLINT_EXIT=$?; tsc --noEmit; TSC_EXIT=$?; if [ $ESLINT_EXIT -ne 0 ] || [ $TSC_EXIT -ne 0 ]; then exit 1; fi'
  • lint:fixeslint . --fix
  • lint:testseslint test/
  • lint:typestsc --noEmit
  • perf:analyzenode scripts/analyze-performance.mjs
  • perf:comparenode scripts/analyze-performance.mjs --baseline
  • perf:dashboardnode scripts/generate-performance-dashboard.mjs
  • preparehusky
  • prepublishOnlyyarn build
  • releasenode scripts/release.mjs
  • …and 12 more.
Dependencies14
  • @emoji-mart/data^1.2.1
  • @types/prismjs^1.26.6
  • fractional-indexing^3.2.0
  • i18next26.0.6
  • katex^0.16.44
  • mdast-util-from-markdown^2.0.3
  • mdast-util-gfm^3.1.0
  • mdast-util-math^3.0.0
  • mermaid^11.14.0
  • micromark-extension-gfm^3.0.0
  • micromark-extension-math^3.1.0
  • nanoid5.1.9
  • prismjs^1.30.0
  • yjs13.6.30