Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@shwfed/[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@shwfed/[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Obfuscation Density: high encoded/escaped-token density
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 462 · status changed
Related candidates
Linked campaigns and clusters
zehua.wang
9 members · evidence strength 84Evidence
Static findings
101 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/dist/runtime/share/layout.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/actions/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/config/blocks/2026-05-17/com.shwfed.block.chart.xy/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-04-27/com.shwfed.form.field.daterange/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-04-27/com.shwfed.form.field.datetimerange/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-04-28/com.shwfed.form.field.numberrange/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-04-29/com.shwfed.form.field.combobox.single/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-05-12/com.shwfed.form.field.upload/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-05-13/com.shwfed.form.field.combobox.single.remote/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-05-23/com.shwfed.form.field.tree.multi/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-05-24/com.shwfed.form.field.monthrange/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/table/columns/2026-05-24/com.shwfed.table.column.combobox-single.remote.options-remote/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/table/columns/2026-05-24/com.shwfed.table.column.combobox-single.remote.options-static/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/table/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/table/utils/shared.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/dist/preview/assets/index-B2gp2q3H.js | 2462564 bytes | 10 |
| medium | Large Javascript Payload | package/dist/mcp.mjs | 3324267 bytes | 10 |
Show all 101 findings (low-signal and informational)
Showing 60 of 101 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/dist/runtime/share/layout.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/actions/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/config/blocks/2026-05-17/com.shwfed.block.chart.xy/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-04-27/com.shwfed.form.field.daterange/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-04-27/com.shwfed.form.field.datetimerange/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-04-28/com.shwfed.form.field.numberrange/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-04-29/com.shwfed.form.field.combobox.single/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-05-12/com.shwfed.form.field.upload/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-05-13/com.shwfed.form.field.combobox.single.remote/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-05-23/com.shwfed.form.field.tree.multi/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/fields/2026-05-24/com.shwfed.form.field.monthrange/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/form/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/table/columns/2026-05-24/com.shwfed.table.column.combobox-single.remote.options-remote/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/table/columns/2026-05-24/com.shwfed.table.column.combobox-single.remote.options-static/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/table/schema.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/runtime/components/table/utils/shared.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/dist/preview/assets/index-B2gp2q3H.js | 2462564 bytes | 10 |
| medium | Large Javascript Payload | package/dist/mcp.mjs | 3324267 bytes | 10 |
| low | Install-time lifecycle script | package.json | prepare="husky && nuxt prepare" | 4 |
| low | Obfuscation | package/dist/runtime/components/form/utils/cel-scope.js | matched "\\u8868" | 3 |
| low | Obfuscation | package/dist/runtime/components/form/utils/common.js | matched "\\u5B57" | 3 |
| low | Obfuscation | package/dist/runtime/utils/config-clipboard.js | matched "\\u6211" | 3 |
| low | Obfuscation | package/dist/runtime/vendor/cel-js/lib/evaluator.js | matched "Eval(" | 3 |
| low | Obfuscation | package/dist/runtime/share/event-bus.js | matched "\\u76EE" | 3 |
| low | Obfuscation | package/dist/runtime/share/expression.js | matched "\\u81EA" | 3 |
| low | Obfuscation | package/dist/runtime/vendor/cel-js/lib/http-builtins.js | matched "\\u5BA2" | 3 |
| low | Obfuscation | package/dist/runtime/utils/ai/index.js | matched "\\u6A21" | 3 |
| low | Obfuscation | package/dist/runtime/vendor/cel-js/lib/json-builtins.js | matched "\\u7F16" | 3 |
| low | Obfuscation | package/dist/runtime/share/layout.js | matched "\\u7F51" | 3 |
| low | Obfuscation | package/dist/runtime/share/locale.js | matched "\\u5FC5" | 3 |
| low | Obfuscation | package/dist/runtime/vendor/cel-js/lib/macros.js | matched "eval(" | 3 |
| low | Obfuscation | package/dist/runtime/vendor/cel-js/lib/operators.js | matched "eval(" | 3 |
| low | Obfuscation | package/dist/runtime/vendor/cel-js/lib/optional.js | matched "eval(" | 3 |
| low | Obfuscation | package/dist/runtime/vendor/cel-js/lib/parser.js | matched "\\x07" | 3 |
| low | Obfuscation | package/dist/runtime/components/actions/utils/resolve.js | matched "\\u5DF2" | 3 |
| low | Obfuscation | package/dist/runtime/components/config/utils/resolve.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/runtime/components/actions/buttons/2026-04-18/com.shwfed.actions.button.http.request.json.confirm/schema.js | matched "\\u7F51" | 3 |
| low | Obfuscation | package/dist/runtime/components/actions/buttons/2026-04-18/com.shwfed.actions.button.http.request.json/schema.js | matched "\\u7F51" | 3 |
| low | Obfuscation | package/dist/runtime/components/actions/buttons/2026-04-18/com.shwfed.actions.button.prototype/schema.js | matched "\\u539F" | 3 |
| low | Obfuscation | package/dist/runtime/components/actions/buttons/2026-04-21/com.shwfed.actions.button.navigation/schema.js | matched "\\u5BFC" | 3 |
| low | Obfuscation | package/dist/runtime/components/actions/buttons/2026-05-11/com.shwfed.actions.button.modal.layout/schema.js | matched "\\u6A21" | 3 |
| low | Obfuscation | package/dist/runtime/components/actions/buttons/2026-05-15/com.shwfed.actions.button.event.dispatch/schema.js | matched "\\u89E6" | 3 |
| low | Obfuscation | package/dist/runtime/components/actions/buttons/2026-05-21/com.shwfed.actions.button.http.download/schema.js | matched "\\u4E0B" | 3 |
| low | Obfuscation | package/dist/runtime/components/actions/buttons/2026-05-24/com.shwfed.actions.button.state.write/schema.js | matched "\\u5199" | 3 |
| low | Obfuscation | package/dist/runtime/components/actions/items/2026-05-21/com.shwfed.actions.item.markdown/schema.js | matched "\\u5185" | 3 |
| low | Obfuscation | package/dist/runtime/components/actions/schema.js | matched "\\u6309" | 3 |
| low | Obfuscation | package/dist/runtime/components/config/blocks/2026-05-06/com.shwfed.block.actions/schema.js | matched "\\u64CD" | 3 |
| low | Obfuscation | package/dist/runtime/components/config/blocks/2026-05-06/com.shwfed.block.form/schema.js | matched "\\u8868" | 3 |
| low | Obfuscation | package/dist/runtime/components/config/blocks/2026-05-06/com.shwfed.block.markdown/schema.js | matched "\\u5757" | 3 |
| low | Obfuscation | package/dist/runtime/components/config/blocks/2026-05-06/com.shwfed.block.table/schema.js | matched "\\u8868" | 3 |
| low | Obfuscation | package/dist/runtime/components/config/blocks/2026-05-06/com.shwfed.block.tabs/schema.js | matched "\\u6807" | 3 |
| low | Obfuscation | package/dist/runtime/components/config/blocks/2026-05-17/com.shwfed.block.chart.xy/schema.js | matched "\\u56FE" | 3 |
| low | Obfuscation | package/dist/runtime/components/config/schema.js | matched "\\u9875" | 3 |
| low | Obfuscation | package/dist/runtime/components/form/fields/2026-04-22/com.shwfed.form.field.markdown/schema.js | matched "\\u5185" | 3 |
| low | Obfuscation | package/dist/runtime/components/form/fields/2026-04-22/com.shwfed.form.field.text/schema.js | matched "\\u6587" | 3 |
| low | Obfuscation | package/dist/runtime/components/form/fields/2026-04-22/com.shwfed.form.field.textarea/schema.js | matched "\\u591A" | 3 |
| low | Obfuscation | package/dist/runtime/components/form/fields/2026-04-24/com.shwfed.form.field.actions/schema.js | matched "\\u64CD" | 3 |
| low | Obfuscation | package/dist/runtime/components/form/fields/2026-04-24/com.shwfed.form.field.combobox.single/schema.js | matched "\\u4E0B" | 3 |
| low | Obfuscation | package/dist/runtime/components/form/fields/2026-04-27/com.shwfed.form.field.date/schema.js | matched "\\u65E5" | 3 |
| low | Obfuscation | package/dist/runtime/components/form/fields/2026-04-27/com.shwfed.form.field.daterange/schema.js | matched "\\u8D77" | 3 |
Manifest
Package metadata
Scripts10
devnpm run dev:prepare && nuxt dev playgrounddev:buildnuxt build playgrounddev:preparenuxt-module-build build --stub && nuxt-module-build prepare && nuxt prepare playgroundlinteslint .prepacknuxt-module-build build && vite build --config vite.mcp.config.ts && vite build --config vite.preview.config.ts && chmod +x dist/mcp.mjspreparehusky && nuxt preparereleasenpm run lint && npm run test && npm run prepack && bumpp && npm publishtestvitest runtest:typesvue-tsc --noEmit && cd playground && vue-tsc --noEmittest:watchvitest watch
Dependencies30
@atlaskit/pragmatic-drag-and-drop^1.8.1@atlaskit/pragmatic-drag-and-drop-hitbox^1.1.0@date-fns/tz^1.4.1@iconify/vue^5.0.1@internationalized/date^3.12.1@intlify/unplugin-vue-i18n^11.2.3@modelcontextprotocol/sdk^1.29.0@nuxt/kit^4.4.5@tailwindcss/typography^0.5.19@tailwindcss/vite^4.3.0@tanstack/vue-table^8.21.3@tanstack/vue-virtual^3.13.24@unovis/ts^1.6.5@unovis/vue^1.6.5@vueuse/core^14.3.0class-variance-authority^0.7.1clsx^2.1.1date-fns^4.1.0defu^6.1.7dot-prop^10.1.0effect^3.21.2fx-fetch^1.1.2markdown-it^14.1.1reka-ui^2.9.7tailwind-merge^3.6.0tailwindcss^4.3.0vaul-vue^0.4.1vue-i18n^11.4.4vue-sonner^2.0.0zod^4.4.3