Package evidence

@tencentcloud/[email protected]

Remote Dependency Spec: dependencies.tiw-mathjs="https://res.qcloudtiw.com/board/third/node_modules/tiw-mathjs.tar.gz"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 25Mature · −50% score
First published: Oct 2023
Publisher: bernlao

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@tencentcloud/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@tencentcloud/[email protected]"],"fail_on":"review"}'

Publisherbernlao

Artifact bytes732,941

Previous version2.9.2-2

Published2025-05-28T07:38:53.697Z

SHA-2564f9650f7986511b0199f24348af5dd810ee31ba02ccd2c12588ebdcbe04a23c6

Why flagged

What the scanner saw

Remote Dependency Spec: dependencies.tiw-mathjs="https://res.qcloudtiw.com/board/third/node_modules/tiw-mathjs.tar.gz"

1 remote tarball(s) were followed statically.

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

18d agoLast checked

reviewRisk

6Score

2.9.2-3Version

Status history (1 event)

new → available18d ago · risk review · score 6 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Remote Dependency Spec	package.json	dependencies.tiw-mathjs="https://res.qcloudtiw.com/board/third/node_modules/tiw-mathjs.tar.gz"	12

Remote payloads

Followed remote artifacts

Source	URL	Risk	Score	Summary
dependencies.tiw-mathjs	https://res.qcloudtiw.com/board/third/node_modules/tiw-mathjs.tar.gz	low	0	no remote findings

Manifest

Package metadata

Scripts16

cinpx babel --config-file=./h5ppt.babelrc ./ci/sdk-beta-v1.1.9.js --out-file ./ci/release/sdk-beta-v1.1.9-babel.js --presets=@babel/preset-env && uglifyjs ./ci/release/sdk-beta-v1.1.9-babel.js -m -o ci/release/sdk-beta-v1.1.9.js
democd demo && npx live-server --port=5555 --open=?roomid=187701
devwebpack --watch --config webpack.dev.js
dev_cachewebpack --watch --config webpack.dev.js --env.assetsProtocol=teducache
dev_cache_publishwebpack --config webpack.dev.publish.js --env.assetsProtocol=teducache
dev_publishwebpack --config webpack.dev.publish.js
docnpm run ts && npm run doc:replace && npm run doc:clean && npm run doc:override && npm run doc:build
doc:buildjsdoc -c ./jsdoc/doc.config.json
doc:cleanrm -rf ./jsdoc/dist
doc:overridecp -r ./jsdoc/docdash-blue/* ./node_modules/docdash-blue/
doc:replacenode jsdoc/replace.js
prodwebpack --config webpack.prod.js
prod:esmwebpack --config webpack.esm.prod.js
prod_cachewebpack --config webpack.prod.js --env.assetsProtocol=teducache
testnode test/test.js
tstsc --build

Dependencies14

alloyfinger^0.1.16
clipboard^2.0.6
core-js^2.6.9
cos-wx-sdk-v5^0.7.10
es6-object-assign^1.1.0
es6-proxy-polyfill^2.1.1
es7-object-polyfill^1.0.0
exif-js^2.3.0
faker^4.1.0
long^4.0.0
lz-string^1.4.4
mp4box^0.5.2
npm-watch^0.7.0
tiw-mathjshttps://res.qcloudtiw.com/board/third/node_modules/tiw-mathjs.tar.gz