PkgRadar

Package evidence

@shwfed/[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
51
First published
May 2026
Publisher
zehua.wang

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@shwfed/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@shwfed/[email protected]"],"fail_on":"review"}'
Publisherzehua.wang
Artifact bytes1,972,185
Previous version2.3.28
Published2026-05-28T09:15:39.501Z
SHA-256a541a0e60f10a7868504ed23403cda6a637d0f3411e747c203c8786e28e7920d

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
70Score
2.3.29Version
Status history (1 event)
  1. new → available · risk review · score 70 · status changed

Evidence

Static findings

24 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/runtime/share/layout.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/actions/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/form/fields/2026-04-29/com.shwfed.form.field.combobox.single/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/form/fields/2026-05-13/com.shwfed.form.field.combobox.single.remote/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/form/fields/2026-05-28/com.shwfed.form.field.combobox.multi/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/form/fields/2026-05-28/com.shwfed.form.field.combobox.single/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/form/fields/2026-05-28/com.shwfed.form.field.tree.combobox.multi/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/form/fields/2026-05-28/com.shwfed.form.field.tree.combobox.single/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/form/fields/2026-05-28/com.shwfed.form.field.tree.multi/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-24/com.shwfed.table.column.combobox-single.remote.options-remote/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-25/com.shwfed.table.column.combobox-multi.remote.options-remote/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-26/com.shwfed.table.column.combobox-multi.remote/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-26/com.shwfed.table.column.combobox-multi/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-26/com.shwfed.table.column.combobox-single.remote/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-26/com.shwfed.table.column.combobox-single/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-27/com.shwfed.table.column.tree-combobox-multi/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-27/com.shwfed.table.column.tree-combobox-single/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-28/com.shwfed.table.column.combobox-multi/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-28/com.shwfed.table.column.combobox-single/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-28/com.shwfed.table.column.tree-combobox-multi/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/columns/2026-05-28/com.shwfed.table.column.tree-combobox-single/schema.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist/runtime/components/table/schema.jshigh encoded/escaped-token density12
mediumLarge Javascript Payloadpackage/dist/preview/assets/index-DEF3_MKr.js3042745 bytes10
mediumLarge Javascript Payloadpackage/dist/mcp.mjs3477356 bytes10

Manifest

Package metadata

Scripts10
  • devnpm run dev:prepare && nuxt dev playground
  • dev:buildnuxt build playground
  • dev:preparenuxt-module-build build --stub && nuxt-module-build prepare && nuxt prepare playground
  • linteslint .
  • prepacknuxt-module-build build && vite build --config vite.mcp.config.ts && vite build --config vite.preview.config.ts && chmod +x dist/mcp.mjs
  • preparehusky && nuxt prepare
  • releasenpm run lint && npm run test && npm run prepack && bumpp && npm publish
  • testvitest run
  • test:typesvue-tsc --noEmit && cd playground && vue-tsc --noEmit
  • test:watchvitest watch
Dependencies30
  • @atlaskit/pragmatic-drag-and-drop^1.8.1
  • @atlaskit/pragmatic-drag-and-drop-hitbox^1.1.0
  • @date-fns/tz^1.4.1
  • @iconify/vue^5.0.1
  • @internationalized/date^3.12.1
  • @intlify/unplugin-vue-i18n^11.2.3
  • @modelcontextprotocol/sdk^1.29.0
  • @nuxt/kit^4.4.5
  • @tailwindcss/typography^0.5.19
  • @tailwindcss/vite^4.3.0
  • @tanstack/vue-table^8.21.3
  • @tanstack/vue-virtual^3.13.24
  • @unovis/ts^1.6.5
  • @unovis/vue^1.6.5
  • @vueuse/core^14.3.0
  • class-variance-authority^0.7.1
  • clsx^2.1.1
  • date-fns^4.1.0
  • defu^6.1.7
  • dot-prop^10.1.0
  • effect^3.21.2
  • fx-fetch^1.1.2
  • markdown-it^14.1.1
  • reka-ui^2.9.7
  • tailwind-merge^3.6.0
  • tailwindcss^4.3.0
  • vaul-vue^0.4.1
  • vue-i18n^11.4.4
  • vue-sonner^2.0.0
  • zod^4.4.3