npm · registry.npmjs.org

@salesforce/afv-skills

Remote Payload: matched "curl "

Why PkgRadar flagged 1.10.0

Severity	Signal	Evidence
medium	Remote Payload	matched "curl " · package/skills/generating-visual-diagrams/scripts/check-prerequisites.sh

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`1.15.0`	Low risk	0	2026-06-12
`1.14.0`	Low risk	0	2026-06-03
`1.13.0`	Low risk	0	2026-06-01
`1.12.0`	Low risk	0	2026-05-29
`1.10.0`	Review	12	2026-05-24
`1.11.0`	Review	12	2026-05-24

Block this in CI

PkgRadar gates @salesforce/afv-skills (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @salesforce/[email protected]