PkgRadar

npm · registry.npmjs.org

@salesforce/pwa-kit-runtime

Remote Payload: matched "cUrl "

Why PkgRadar flagged 3.19.0-nightly-20260525091538

SeveritySignalEvidence
mediumRemote Payloadmatched "cUrl " · package/utils/ssr-proxying.js

Scanned versions

VersionVerdictScoreScanned (UTC)
3.19.0-nightly-20260612091933Low risk02026-06-12
3.19.0-nightly-20260611092422Low risk02026-06-11
3.19.0-nightly-20260610090914Low risk02026-06-10
3.19.0-nightly-20260609090308Low risk02026-06-09
3.19.0-nightly-20260608093039Low risk02026-06-08
3.19.0-nightly-20260605090341Low risk02026-06-05
3.19.0-nightly-20260604091504Low risk02026-06-04
3.19.0-nightly-20260603093136Low risk02026-06-03
3.19.0-nightly-20260602092158Low risk02026-06-02
3.19.0-nightly-20260601094525Low risk02026-06-01
3.19.0-nightly-20260529090345Low risk02026-05-29
3.19.0-nightly-20260528090831Low risk02026-05-28
3.19.0-nightly-20260527090333Low risk02026-05-27
3.19.0-nightly-20260526090339Low risk02026-05-26
3.19.0-nightly-20260525091538Review122026-05-25
3.18.1Review122026-05-25

Block this in CI

PkgRadar gates @salesforce/pwa-kit-runtime (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @salesforce/[email protected]