Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 3,031Niche · −30% score
- Versions published
- 1,622Mature · −50% score
- First published
- Aug 2023
- Publisher
- fchienvuhoang
Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Remote Payload: matched "cUrl "
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 62 · status changed
Evidence
Static findings
152 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/dist/cjs/axiosInstance.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dist/esm/axiosInstance.js | matched "cUrl " | 12 |
Show all 152 findings (low-signal and informational)
Showing 60 of 152 findings.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/dist/cjs/axiosInstance.js | matched "cUrl " | 12 |
| medium | Remote Payload | package/dist/esm/axiosInstance.js | matched "cUrl " | 12 |
| low | Obfuscation | package/dist/cjs/components/MainWrapV4/quick-action/library/library-create-ticket/book-borrow-info.js | matched "\\u00F4" | 3 |
| low | Obfuscation | package/dist/esm/components/MainWrapV4/quick-action/library/library-create-ticket/book-borrow-info.js | matched "\\u00F4" | 3 |
| low | Obfuscation | package/dist/cjs/components/ResourceList/component/bulkAction.js | matched "\\u1ECD" | 3 |
| low | Obfuscation | package/dist/esm/components/ResourceList/component/bulkAction.js | matched "\\u1ECD" | 3 |
| low | Obfuscation | package/dist/cjs/components/UploadFile/ButtonUpload.js | matched "\\u1EA3" | 3 |
| low | Obfuscation | package/dist/esm/components/UploadFile/ButtonUpload.js | matched "\\u1EA3" | 3 |
| low | Obfuscation | package/dist/cjs/components/DateRangePicker/components/Calendar.js | matched "\\u1EF7" | 3 |
| low | Obfuscation | package/dist/esm/components/DateRangePicker/components/Calendar.js | matched "\\u1EF7" | 3 |
| low | Obfuscation | package/dist/cjs/components/Combobox/Combobox.js | matched "\\u1EA5" | 3 |
| low | Obfuscation | package/dist/esm/components/Combobox/Combobox.js | matched "\\u1EA5" | 3 |
| low | Obfuscation | package/dist/cjs/components/FormTarget/components/modal-import/confirm-upload.js | matched "\\u1EA3" | 3 |
| low | Obfuscation | package/dist/esm/components/FormTarget/components/modal-import/confirm-upload.js | matched "\\u1EA3" | 3 |
| low | Obfuscation | package/dist/cjs/components/TableV3/EmptyRecord.js | matched "\\u1EEF" | 3 |
| low | Obfuscation | package/dist/esm/components/TableV3/EmptyRecord.js | matched "\\u1EEF" | 3 |
| low | Obfuscation | package/dist/cjs/components/SearchResultListV3/EmptySearchResult.js | matched "\\u00F4" | 3 |
| low | Obfuscation | package/dist/esm/components/SearchResultListV3/EmptySearchResult.js | matched "\\u00F4" | 3 |
| low | Obfuscation | package/dist/cjs/components/MainWrapV4/components/fixed-action.js | matched "\\u0111" | 3 |
| low | Obfuscation | package/dist/esm/components/MainWrapV4/components/fixed-action.js | matched "\\u0111" | 3 |
| low | Obfuscation | package/dist/cjs/components/FormConfigTimeUseService/FormConfigTimeUseService.js | matched "\\u00E0" | 3 |
| low | Obfuscation | package/dist/esm/components/FormConfigTimeUseService/FormConfigTimeUseService.js | matched "\\u00E0" | 3 |
| low | Obfuscation | package/dist/cjs/components/FormTuitionV3/FormTuitionV3.js | matched "\\u1EBF" | 3 |
| low | Obfuscation | package/dist/esm/components/FormTuitionV3/FormTuitionV3.js | matched "\\u1EBF" | 3 |
| low | Obfuscation | package/dist/cjs/components/UploadFile/FormUpload.js | matched "\\u1EA3" | 3 |
| low | Obfuscation | package/dist/esm/components/UploadFile/FormUpload.js | matched "\\u1EA3" | 3 |
| low | Obfuscation | package/dist/cjs/components/FormWrap/FormWrap.js | matched "\\u00E1" | 3 |
| low | Obfuscation | package/dist/esm/components/FormWrap/FormWrap.js | matched "\\u00E1" | 3 |
| low | Obfuscation | package/dist/cjs/components/HeaderBar/HeaderBar.js | matched "\\u00E1" | 3 |
| low | Obfuscation | package/dist/esm/components/HeaderBar/HeaderBar.js | matched "\\u00E1" | 3 |
| low | Obfuscation | package/dist/cjs/components/MainWrapV4/helper.js | matched "\\u0300" | 3 |
| low | Obfuscation | package/dist/esm/components/MainWrapV4/helper.js | matched "\\u0300" | 3 |
| low | Obfuscation | package/dist/cjs/helpers/helpers.js | matched "\\u0300" | 3 |
| low | Obfuscation | package/dist/esm/helpers/helpers.js | matched "\\u0300" | 3 |
| low | Obfuscation | package/dist/cjs/components/MainWrapV4/quick-action/library/library-create-ticket/index.js | matched "\\u00EA" | 3 |
| low | Obfuscation | package/dist/esm/components/MainWrapV4/quick-action/library/library-create-ticket/index.js | matched "\\u00EA" | 3 |
| low | Obfuscation | package/dist/cjs/components/Input/Input.js | matched "\\u00EA" | 3 |
| low | Obfuscation | package/dist/esm/components/Input/Input.js | matched "\\u00EA" | 3 |
| low | Obfuscation | package/dist/cjs/components/MainWrapV4/components/left-heder-section.js | matched "\\u1ECD" | 3 |
| low | Obfuscation | package/dist/esm/components/MainWrapV4/components/left-heder-section.js | matched "\\u1ECD" | 3 |
| low | Obfuscation | package/dist/cjs/components/TextEditorV2/plugins/ToolbarPlugin/components/link.js | matched "\\u00E8" | 3 |
| low | Obfuscation | package/dist/esm/components/TextEditorV2/plugins/ToolbarPlugin/components/link.js | matched "\\u00E8" | 3 |
| low | Obfuscation | package/dist/cjs/components/LoginSsoV3/login-sso-v3.js | matched "\\u00E0" | 3 |
| low | Obfuscation | package/dist/esm/components/LoginSsoV3/login-sso-v3.js | matched "\\u00E0" | 3 |
| low | Obfuscation | package/dist/cjs/components/LoginV3/LoginV3.js | matched "\\u0110" | 3 |
| low | Obfuscation | package/dist/esm/components/LoginV3/LoginV3.js | matched "\\u0110" | 3 |
| low | Obfuscation | package/dist/cjs/components/MainWrapV4/components/main-content.js | matched "\\u1EA1" | 3 |
| low | Obfuscation | package/dist/esm/components/MainWrapV4/components/main-content.js | matched "\\u1EA1" | 3 |
| low | Obfuscation | package/dist/cjs/components/MainWrapV3/MainWrapV3.js | matched "\\u1ECD" | 3 |
| low | Obfuscation | package/dist/esm/components/MainWrapV3/MainWrapV3.js | matched "\\u1ECD" | 3 |
| low | Obfuscation | package/dist/cjs/components/MainWrapV4/MainWrapV4.js | matched "\\u00F9" | 3 |
| low | Obfuscation | package/dist/esm/components/MainWrapV4/MainWrapV4.js | matched "\\u00F9" | 3 |
| low | Obfuscation | package/dist/cjs/components/Preview-noti/mobile-preview/mobile-preview.js | matched "\\u1EBF" | 3 |
| low | Obfuscation | package/dist/esm/components/Preview-noti/mobile-preview/mobile-preview.js | matched "\\u1EBF" | 3 |
| low | Obfuscation | package/dist/cjs/components/MainWrapV4/quick-action/library/library-create-ticket/modal-add-book.js | matched "\\u00EA" | 3 |
| low | Obfuscation | package/dist/esm/components/MainWrapV4/quick-action/library/library-create-ticket/modal-add-book.js | matched "\\u00EA" | 3 |
| low | Obfuscation | package/dist/cjs/components/FormTarget/components/modal-delete/modal-delete.js | matched "\\u00E1" | 3 |
| low | Obfuscation | package/dist/esm/components/FormTarget/components/modal-delete/modal-delete.js | matched "\\u00E1" | 3 |
| low | Obfuscation | package/dist/cjs/components/FormTarget/components/modal-import/modal-import-user.js | matched "\\u0110" | 3 |
| low | Obfuscation | package/dist/esm/components/FormTarget/components/modal-import/modal-import-user.js | matched "\\u0110" | 3 |
Manifest
Package metadata
Scripts12
buildyarn build:esm && yarn build:cjs && yarn build:assetsbuild-storybookstorybook buildbuild:assetscp -R src/components/MainWrapV3/assets dist/cjs/components/MainWrapV3 && cp -R src/components/MainWrapV3/assets dist/esm/components/MainWrapV3 && cp -R src/assets dist/cjs && cp -R src/assets dist/esm && cp -R src/components/MainWrapV4/assets dist/cjs/components/MainWrapV4 && cp -R src/components/MainWrapV4/assets dist/esm/components/MainWrapV4build:cjstsc --module commonjs --outDir dist/cjsbuild:esmtsclinteslint "{**/*,*}.{js,ts,jsx,tsx}"preparenpm run buildprepublishOnlynpm test && npm run prettierprettierprettier --write "{src,tests,example/src}/**/*.{js,ts,jsx,tsx}"pubyarn build && npm publishstorybookstorybook dev -p 6006testjest --config jestconfig.json
Dependencies38
@excalidraw/excalidraw^0.17.6@lexical/file^0.44.0@lexical/headless^0.44.0@lexical/list^0.44.0@lexical/react^0.44.0@lexical/selection^0.44.0@sentry/nextjs^10.30.0@tiptap/core^3.4.6@tiptap/extension-color^3.4.6@tiptap/extension-heading^3.4.6@tiptap/extension-image^3.4.6@tiptap/extension-link^3.4.6@tiptap/extension-placeholder^3.6.6@tiptap/extension-text-align^3.4.6@tiptap/extension-text-style^3.4.6@tiptap/extension-underline^3.4.6@tiptap/react^3.4.6@tiptap/starter-kit^3.4.6async-lock^1.4.1axios^1.5.0crypto-js^4.2.0date-fns^4.1.0emoji-picker-react4.0.8framer-motion^12.23.24katex^0.16.22lexical^0.44.0lodash-es^4.17.21lodash.isboolean^3.0.3lodash.isequal^4.5.0react-colorful^5.6.1- …and 8 more.