Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@tntd/[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@tntd/[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Obfuscation Density: high encoded/escaped-token density
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 312 · status changed
Related candidates
Linked campaigns and clusters
zhouzefei
2 members · evidence strength 64Evidence
Static findings
58 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/dist/vs/language/css/cssWorker.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.de.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.es.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.fr.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.it.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.ja.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.ko.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.ru.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.zh-cn.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.zh-tw.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/basic-languages/freemarker2/freemarker2.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/language/html/htmlWorker.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/base/worker/workerMain.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/dist/vs/editor/editor.main.js | 3520673 bytes | 10 |
| medium | Large Javascript Payload | package/dist/index.js | 2067740 bytes | 10 |
| medium | Large Javascript Payload | package/dist/vs/language/typescript/tsWorker.js | 4553060 bytes | 10 |
Show all 58 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/dist/vs/language/css/cssWorker.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.de.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.es.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.fr.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.it.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.ja.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.ko.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.ru.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.zh-cn.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/editor/editor.main.nls.zh-tw.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/basic-languages/freemarker2/freemarker2.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/language/html/htmlWorker.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist/vs/base/worker/workerMain.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/dist/vs/editor/editor.main.js | 3520673 bytes | 10 |
| medium | Large Javascript Payload | package/dist/index.js | 2067740 bytes | 10 |
| medium | Large Javascript Payload | package/dist/vs/language/typescript/tsWorker.js | 4553060 bytes | 10 |
| low | Obfuscation | package/dist/vs/language/css/cssWorker.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/cypher/cypher.js | matched "\\x3e" | 3 |
| low | Obfuscation | package/dist/vs/editor/editor.main.nls.de.js | matched "\\xdf" | 3 |
| low | Obfuscation | package/dist/vs/editor/editor.main.nls.es.js | matched "\\xfa" | 3 |
| low | Obfuscation | package/dist/vs/editor/editor.main.nls.fr.js | matched "\\xe9" | 3 |
| low | Obfuscation | package/dist/vs/editor/editor.main.nls.it.js | matched "\\xe8" | 3 |
| low | Obfuscation | package/dist/vs/editor/editor.main.nls.ja.js | matched "\\u5165" | 3 |
| low | Obfuscation | package/dist/vs/editor/editor.main.nls.ko.js | matched "\\uc785" | 3 |
| low | Obfuscation | package/dist/vs/editor/editor.main.nls.ru.js | matched "\\u0432" | 3 |
| low | Obfuscation | package/dist/vs/editor/editor.main.nls.zh-cn.js | matched "\\u8f93" | 3 |
| low | Obfuscation | package/dist/vs/editor/editor.main.nls.zh-tw.js | matched "\\u8f38" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/freemarker2/freemarker2.js | matched "\\u00AA" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/handlebars/handlebars.js | matched "\\x3c" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/html/html.js | matched "\\x3c" | 3 |
| low | Obfuscation | package/dist/vs/language/html/htmlWorker.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist/vs/language/json/jsonMode.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/vs/language/json/jsonWorker.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/julia/julia.js | matched "\\u03c0" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/liquid/liquid.js | matched "\\x3c" | 3 |
| low | Obfuscation | package/dist/vs/loader.js | matched "Eval(" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/markdown/markdown.js | matched "\\x3c" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/mdx/mdx.js | matched "\\u201c" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/razor/razor.js | matched "\\x3c" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/restructuredtext/restructuredtext.js | matched "\\x3c" | 3 |
| low | Obfuscation | package/dist/vs/base/common/worker/simpleWorker.nls.de.js | matched "\\xfc" | 3 |
| low | Obfuscation | package/dist/vs/base/common/worker/simpleWorker.nls.es.js | matched "\\xf3" | 3 |
| low | Obfuscation | package/dist/vs/base/common/worker/simpleWorker.nls.fr.js | matched "\\xe9" | 3 |
| low | Obfuscation | package/dist/vs/base/common/worker/simpleWorker.nls.it.js | matched "\\xe0" | 3 |
| low | Obfuscation | package/dist/vs/base/common/worker/simpleWorker.nls.ja.js | matched "\\u914d" | 3 |
| low | Obfuscation | package/dist/vs/base/common/worker/simpleWorker.nls.ko.js | matched "\\ubc30" | 3 |
| low | Obfuscation | package/dist/vs/base/common/worker/simpleWorker.nls.ru.js | matched "\\u043c" | 3 |
| low | Obfuscation | package/dist/vs/base/common/worker/simpleWorker.nls.zh-cn.js | matched "\\u6570" | 3 |
| low | Obfuscation | package/dist/vs/base/common/worker/simpleWorker.nls.zh-tw.js | matched "\\u9663" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/sparql/sparql.js | matched "\\u00a0" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/st/st.js | matched "\\u0441" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/swift/swift.js | matched "\\u00A1" | 3 |
| low | Obfuscation | package/umd/tntd-monaco.min.js | matched "\\u0009" | 3 |
| low | Obfuscation | package/dist/vs/language/typescript/tsMode.js | matched "\\u2014" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/twig/twig.js | matched "\\x3c" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/vb/vb.js | matched "\\u201c" | 3 |
| low | Obfuscation | package/dist/vs/base/worker/workerMain.js | matched "Eval(" | 3 |
| low | Obfuscation | package/dist/vs/basic-languages/xml/xml.js | matched "\\x3c" | 3 |
Manifest
Package metadata
Scripts4
buildrm -rf ./dist && webpack --config webpack.config.build.jsbuild:umdwebpack --config webpack.umd.config.jsprepublishOnlynpm run buildstartwebpack-dev-server --config webpack.config.js
Dependencies3
@monaco-editor/loader~1.5.0@tntd/cascader-tag^0.1.0monaco-editor^0.47.0