This package matches a known-malicious advisory and is blocked by ShadowCanopy by default across every project. 2 flagged versions.
Minified/bundled Markdown parser (micromark + remark extensions). The 'obfuscation' findings are just minification + a large punctuation regex for Markdown tokenization. No malicious behavior in the provided source.
AI breakdown
Plain-English summary of what this package does and how it behaves.
@lint-md/parser is a Markdown parser for lint-md that converts Markdown strings to an AST using the remark ecosystem.
Capabilities
- Converts Markdown strings to AST
- Bundles with esbuild (minified CJS/ESM)
- Generates TypeScript declarations
Data access
- None observed
Network
- No network access observed
Minified bundles trigger obfuscation findings typical of production builds; review source before adopting in high-trust environments.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Obfuscated / hidden code
Encoded payloads decoded statically (without executing them) so you can see what they resolve to.
Multiple obfuscation patterns in dist/lint-md-parser.cjs
Multiple obfuscation patterns in package/dist/lint-md-parser.cjs
Multiple obfuscation patterns in dist/lint-md-parser.mjs
Multiple obfuscation patterns in package/dist/lint-md-parser.mjs
Security findings (4)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in dist/lint-md-parser.cjs
Multiple obfuscation patterns in package/dist/lint-md-parser.cjs
Multiple obfuscation patterns in dist/lint-md-parser.mjs
Multiple obfuscation patterns in package/dist/lint-md-parser.mjs
Files in package (16)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/%40lint-md/parser