Package evidence

@jvs-milkdown/[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 24
First published: Apr 2026
Publisher: jvs-milkdown

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@jvs-milkdown/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@jvs-milkdown/[email protected]"],"fail_on":"review"}'

Publisherjvs-milkdown

Artifact bytes6,306,114

Previous version1.2.12

Published2026-05-14T03:49:36.569Z

SHA-2565f4236532bfdf7fdb12bd0db88937c008b7a4424c689b1490c8b02d4824f9c4d

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

18d agoLast checked

reviewRisk

50Score

1.2.13Version

Status history (1 event)

new → available18d ago · risk review · score 50 · status changed

Evidence

Static findings

10 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Obfuscation Density	package/lib/cjs/builder.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/lib/esm/builder.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/lib/cjs/feature/cursor/index.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/lib/cjs/feature/image-block/index.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/lib/cjs/feature/latex/index.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/lib/cjs/feature/placeholder/index.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/lib/esm/feature/cursor/index.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/lib/esm/feature/image-block/index.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/lib/esm/feature/latex/index.js	high encoded/escaped-token density	12
medium	Obfuscation Density	package/lib/esm/feature/placeholder/index.js	high encoded/escaped-token density	12

Manifest

Package metadata

Scripts3

buildpnpm run build:es && pnpm run build:theme && echo
build:esrollup -c
build:themepostcss src/theme/**/*.css --base src/theme --dir lib/theme && xcopy /E /I /Y src\theme\fonts lib\theme\fonts

Dependencies19

@codemirror/commands^6.3.3
@codemirror/language^6.10.1
@codemirror/language-data^6.4.1
@codemirror/state^6.4.1
@codemirror/theme-one-dark^6.1.2
@codemirror/view^6.26.0
@floating-ui/dom^1.7.6
@jvs-milkdown/kit^1.2.13
@jvs-milkdown/prose^1.2.13
@jvs-milkdown/utils^1.2.13
@types/lodash-es^4.17.12
clsx^2.0.0
codemirror^6.0.1
katex^0.16.0
lodash-es^4.17.21
prosemirror-virtual-cursor^0.4.2
remark-math^6.0.0
unist-util-visit^5.0.0
vue^3.5.20