Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Obfuscation Density: high encoded/escaped-token density
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 186 · status changed
Related candidates
Linked campaigns and clusters
yangjiakui
3 members · evidence strength 74Evidence
Static findings
56 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/towxml/parse/parse2/entities/generated/decode-data-html.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/towxml/parse/markdown/markdown.js | high encoded/escaped-token density | 12 |
Show all 56 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/towxml/parse/parse2/entities/generated/decode-data-html.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/towxml/parse/markdown/markdown.js | high encoded/escaped-token density | 12 |
| low | Obfuscation | package/pages/addGame/addGame.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/addSubject/addSubject.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/app.js | matched "\\x20" | 3 |
| low | Obfuscation | package/utils/auth.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/assets/file/badwords-compressed.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/utils/base64.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/components/bottomSheet/bottomSheet.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/towxml/parse/highlight/languages/c-like.js | matched "\\xFF" | 3 |
| low | Obfuscation | package/pages/commonLogin/commonLogin.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/utils/compressImage.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/copyOfficial/copyOfficial.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/towxml/parse/parse2/entities/decode_codepoint.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/towxml/parse/parse2/entities/generated/decode-data-html.js | matched "\\u1d41" | 3 |
| low | Obfuscation | package/towxml/parse/parse2/entities/generated/decode-data-xml.js | matched "\\u0200" | 3 |
| low | Obfuscation | package/towxml/parse/parse2/entities/decode.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/demo/demo.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/towxml/parse/parse2/entities/encode.js | matched "\\x80" | 3 |
| low | Obfuscation | package/towxml/parse/parse2/entities/escape.js | matched "\\x80" | 3 |
| low | Obfuscation | package/utils/exp.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/components/experience-item/experience-item.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/utils/formatPost.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/game/game.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/components/grid-item/grid-item.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/services/home.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/index.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/towxml/parse/markdown/plugins/ins.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/towxml/parse/highlight/languages/java.js | matched "\\u00C0" | 3 |
| low | Obfuscation | package/request/JKRequest.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/lottery-winners/lottery-winners.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/towxml/parse/markdown/plugins/mark.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/towxml/parse/markdown/markdown.js | matched "\\x00" | 3 |
| low | Obfuscation | package/pages/officialWebview/officialWebview.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/utils/parseContent.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/towxml/parse/highlight/languages/php.js | matched "\\x7f" | 3 |
| low | Obfuscation | package/pages/post-editor/post-editor.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/components/post-item/post-item.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/post/post.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/postDialog/postDialog.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/utils/query-select.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/report-category/reporst-category.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/report-category/report-category.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/report-form/report-form.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/assets/file/rules.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/utils/sensitive.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/sevenDaySignDetail/sevenDaySignDetail.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/topic/topic.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/user/user.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/userDatum/userDatum.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/userGameLib/userGameLib.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/webview/webview.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/wheelActivivty/wheelActivivty.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/components/wiki-renderer/wiki-renderer.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/components/wiki-tabs/wiki-tabs.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/pages/wiki/wiki.js | matched "fromCharCode" | 3 |
Manifest
Package metadata
Dependencies2
pako^2.1.0underscore^1.13.6