PkgRadar

Composer · packagist.org

frosh/tools

Remote Payload: matched "raw.githubusercontent.com"

Why PkgRadar flagged 3.8.1

SeveritySignalEvidence
mediumRemote Payloadmatched "raw.githubusercontent.com" · FriendsOfShopware-FroshTools-2b38467/src/Components/Health/Checker/HealthChecker/SwagSecurityChecker.php
mediumRemote Payloadmatched "raw.githubusercontent.com" · FriendsOfShopware-FroshTools-2b38467/src/Components/Security/Checker/ShopwareEolChecker.php
mediumRemote Payloadmatched "raw.githubusercontent.com" · FriendsOfShopware-FroshTools-2b38467/src/Components/Security/ShopwareReleaseService.php

Scanned versions

VersionVerdictScoreScanned (UTC)
3.8.1High risk182026-06-11
3.8.0High risk182026-06-10

Block this in CI

PkgRadar gates frosh/tools (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem composer frosh/[email protected]
Start free — 25 scans / moView full evidence