npm · registry.npmjs.org

@ccslabs/xtend

Why PkgRadar flagged 0.1.0-rc.1

Severity	Signal	Evidence
high	Reverse Shell	matched "mkfifo\|mkfs\|mkisofs\|mknod\|mkswap\|mmv\|more\|most\|mount\|mtools\|mtr\|mutt\|mv\|nano\|nc\|netstat\|nice\|nl\|node\|nohup\|notify-send\|npm\|nslookup\|op\|open\|parted\|passwd\|paste\|pathchk\|ping\|pkill\|pnpm\|podman\|podman-compose\|popd\|pr\|printcap\|printenv\|ps\|pushd\|pv\|quota\|quotacheck\|quotactl\|ram\|rar\|rcp\|reboot\|remsync\|rename\|renice\|rev\|rm\|rmdir\|rpm\|rsync\|scp\|screen\|sdiff\|sed\|sendmail\|seq\|service\|sftp\|sh" — reverse-shell shape · package/components/prism.js

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.1.0-rc.1`	High risk	40	2026-06-20
`0.3.0`	High risk	40	2026-06-20
`0.1.2`	Low risk	0	2026-05-27
`0.2.0`	Low risk	0	2026-05-27

Related campaigns

Block this in CI

PkgRadar gates @ccslabs/xtend (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @ccslabs/[email protected]