PkgRadar

Package evidence

@simon_he/[email protected]

Obfuscation Density: high encoded/escaped-token density

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
179
Versions published
10
First published
Jan 2026
Publisher
simon_he

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@simon_he/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@simon_he/[email protected]"],"fail_on":"review"}'
Publishersimon_he
Artifact bytes1,293,018
Previous version1.0.0
Published2026-05-26T16:24:36.097Z
SHA-2562f9cba8fd830fd02fbc16b727ad56bfb0baa02ee6231feed7aff4e0f9926d50f

Why flagged

What the scanner saw

Obfuscation Density: high encoded/escaped-token density

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
12Score
1.0.1Version
Status history (1 event)
  1. new → available · risk review · score 12 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumObfuscation Densitypackage/dist/markdown.cjshigh encoded/escaped-token density12

Manifest

Package metadata

Scripts73
  • api:check-manifesttsx scripts/check-api-manifest.ts
  • api:difftsx scripts/diff-api-manifest.ts
  • bench:baselinetsx scripts/check-bench-baselines.ts
  • bench:baseline:timingBENCH_TIMING=1 tsx scripts/check-bench-baselines.ts
  • bench:dom-renderertsx scripts/bench-dom-renderer.ts
  • bench:phase2tsx scripts/bench-phase2.ts
  • bench:scroll-mailboxtsx scripts/bench-scroll-mailbox.ts
  • bench:vfortsx scripts/bench-vfor.ts
  • buildpnpm run build:checked
  • build:checkednode scripts/run-build-checked.mjs && node scripts/check-build-warnings.mjs .tmp/build.log
  • build:examplespnpm run build && pnpm -C examples/basic build
  • build:examples:terminalpnpm run build && pnpm -C examples/basic build:terminal
  • build:fastpnpm run build:raw
  • build:rawrimraf dist && tsdown && node scripts/build-cjs.mjs && tsc -p tsconfig.build.json --emitDeclarationOnly && node scripts/fix-vue-dts-compat.mjs && node scripts/create-cjs-dts.mjs
  • check:dist-dtsnode scripts/check-dist-dts.mjs
  • check:hidden-unicodenode scripts/check-hidden-unicode.cjs
  • check:tracked-build-outputnode scripts/check-tracked-build-output.cjs
  • devtsdown --watch
  • docs:buildpnpm run docs:gen && pnpm run docs:check-public-descriptions && pnpm run api:check-manifest && vitepress build docs
  • docs:check-public-descriptionstsx scripts/check-public-api-docs.ts
  • docs:devpnpm run docs:gen && vitepress dev docs
  • docs:gentsx scripts/generate-component-api-docs.ts
  • docs:previewvitepress preview docs
  • e2eplaywright test --project=smoke
  • e2e:browser-regressionsplaywright test --project=browser-regressions-chromium --project=browser-regressions-firefox --project=browser-regressions-webkit
  • e2e:smokeplaywright test --project=smoke
  • example:agent-consolepnpm run build && pnpm -C examples/agent-console dev
  • example:agent-console:smokepnpm run build && pnpm -C examples/agent-console smoke
  • example:agent-console:terminalpnpm run build && pnpm -C examples/agent-console terminal
  • example:agent-console:terminal:smokepnpm run build && pnpm -C examples/agent-console terminal:smoke
  • …and 43 more.
Dependencies1
  • stream-markdown-parser1.0.0