npm · registry.npmjs.org

@corva/create-app

Credential File Packaged: package/common/node/.env

Why PkgRadar flagged 0.118.0

Severity	Signal	Evidence
high	Credential File Packaged	package/common/node/.env · package/common/node/.env
high	Credential File Packaged	package/common/python/.env · package/common/python/.env

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.118.0`	Review	22	2026-05-30
`0.119.0`	Review	22	2026-05-30

Block this in CI

PkgRadar gates @corva/create-app (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @corva/[email protected]