Events from pulldown-cmark:

"<@1>" -> [
  Start(Paragraph)
    Start(Link { link_type: Inline, dest_url: Borrowed("@1"), title: Borrowed(""), id: Borrowed("") })
      Text(Borrowed("@1"))
    End(Link)
  End(Paragraph)
]

Events from commonmark.js:

"<@1>" -> [
  Start(Paragraph)
    Text(Boxed("<@1>"))
  End(Paragraph)
]

XML from commonmark.js:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE document SYSTEM "CommonMark.dtd">
<document xmlns="http://commonmark.org/xml/1.0">
  <paragraph>
    <text>&lt;</text>
    <text>@1&gt;</text>
  </paragraph>
</document>

I looked at the section on autolinks in the spec and the problem seems to be that scan_email accepts @1 as a valid email address. However, the spec says

An email address, for these purposes, is anything that matches the non-normative regex from the HTML5 spec:

/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?
(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/

There is a comment at the start of scan_line saying that the text is scanned by hand to avoid using a regex library. I suppose we could rewrite the code there to parse the regex more faithfully, or perhaps we could pull in a regex library?