PkgRadar

npm · registry.npmjs.org

@actual-app/sync-server

Remote Payload: matched "raw.githubusercontent.com"

Why PkgRadar flagged 26.7.0-nightly.20260613

SeveritySignalEvidence
mediumRemote Payloadmatched "raw.githubusercontent.com" · package/build/chunks/app-mWLyMpfN.js

Scanned versions

VersionVerdictScoreScanned (UTC)
26.7.0-nightly.20260613Review32026-06-13
26.7.0-nightly.20260612Review32026-06-12
26.7.0-nightly.20260611Review32026-06-11
26.7.0-nightly.20260610Review32026-06-10
26.7.0-nightly.20260609Review32026-06-09
26.7.0-nightly.20260608Review32026-06-08
26.7.0-nightly.20260607Review32026-06-07
26.7.0-nightly.20260606Review32026-06-06
26.7.0-nightly.20260605Review32026-06-05
26.7.0-nightly.20260604Review32026-06-04
26.7.0-nightly.20260603Review32026-06-03
26.7.0-nightly.20260602Review32026-06-02
26.6.0Review32026-06-01
26.6.0-nightly.20260601Review32026-06-01
26.6.0-nightly.20260531Review32026-05-31
26.6.0-nightly.20260530Review32026-05-30
26.6.0-nightly.20260529Review52026-05-29
26.6.0-nightly.20260528Review52026-05-28
26.6.0-nightly.20260527Review52026-05-27
26.6.0-nightly.20260526Review52026-05-26
26.6.0-nightly.20260525Review422026-05-25
26.6.0-nightly.20260524Review422026-05-25

Block this in CI

PkgRadar gates @actual-app/sync-server (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @actual-app/[email protected]