PkgRadar

npm · registry.npmjs.org

@shopify/create-app

Credential file access: matched ".npmrc"

Why PkgRadar flagged 0.0.0-nightly-20260617075537

SeveritySignalEvidence
mediumCredential file accessmatched ".npmrc" · package/dist/latest-version-KKU2QQZW.js

Scanned versions

VersionVerdictScoreScanned (UTC)
0.0.0-nightly-20260617075537Review32026-06-17
4.2.0Review32026-06-16
0.0.0-nightly-20260616161348Review32026-06-16
0.0.0-snapshot-20260616121718Review32026-06-16
0.0.0-nightly-20260616120653Review32026-06-16
0.0.0-nightly-20260616100622Review32026-06-16
0.0.0-snapshot-20260616085935Review32026-06-16
0.0.0-nightly-20260616080201Review32026-06-16
0.0.0-nightly-20260615080516Review32026-06-15
0.0.0-nightly-20260614074005Review32026-06-14
0.0.0-nightly-20260613072234Review32026-06-13
0.0.0-snapshot-20260612141153Review32026-06-12
0.0.0-nightly-20260612093548Review32026-06-12
0.0.0-nightly-20260612074146Review32026-06-12
0.0.0-snapshot-20260611111520Review32026-06-11
0.0.0-nightly-20260611074553Review32026-06-11
0.0.0-snapshot-20260610101222Review32026-06-10
0.0.0-nightly-20260610073327Review32026-06-10
0.0.0-snapshot-20260609162508Review32026-06-09
0.0.0-snapshot-20260609114645Review32026-06-09
0.0.0-nightly-20260609071852Review32026-06-09
0.0.0-snapshot-20260608100421Review32026-06-08
0.0.0-nightly-20260608074734Review32026-06-08
0.0.0-nightly-20260607072749Review32026-06-07
0.0.0-nightly-20260606070824Review32026-06-06
0.0.0-snapshot-20260605172558Review32026-06-05
0.0.0-snapshot-20260605131911Review32026-06-05
0.0.0-nightly-20260605073403Review32026-06-05
0.0.0-snapshot-20260604135418Review32026-06-04
0.0.0-snapshot-20260604092612Review32026-06-04
0.0.0-nightly-20260604074230Review32026-06-04
0.0.0-snapshot-20260603134319Review32026-06-03
0.0.0-snapshot-20260603122041Review32026-06-03
0.0.0-nightly-20260603074628Review32026-06-03
0.0.0-snapshot-20260602104654Review32026-06-02
0.0.0-nightly-20260602074323Review32026-06-02
0.0.0-nightly-20260601075121Review32026-06-01
0.0.0-nightly-20260531072224Review152026-05-31
0.0.0-nightly-20260530070427Review152026-05-30
0.0.0-snapshot-20260529202055Review152026-05-29
0.0.0-snapshot-20260529205834Review152026-05-29
0.0.0-snapshot-20260529125211Review152026-05-29
0.0.0-snapshot-20260529134635Review152026-05-29
0.0.0-snapshot-20260529094324Review152026-05-29
0.0.0-snapshot-20260529095708Review152026-05-29
0.0.0-nightly-20260529072502Review152026-05-29
0.0.0-snapshot-20260528213307Review152026-05-29
0.0.0-snapshot-20260528143009Review482026-05-28
0.0.0-snapshot-20260528113027Review482026-05-28
0.0.0-nightly-20260528072525Review482026-05-28
0.0.0-nightly-20260527143603Review362026-05-27
4.1.0Review362026-05-27
0.0.0-snapshot-20260526094552Review362026-05-26
0.0.0-nightly-20260526071712Review362026-05-26
0.0.0-snapshot-20260525120835Review362026-05-25
0.0.0-nightly-20260525073851Review1272026-05-25
0.0.0-nightly-20260523065831Review1142026-05-24
0.0.0-nightly-20260524071012Review1142026-05-24

Block this in CI

PkgRadar gates @shopify/create-app (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @shopify/[email protected]
Start free — 25 scans / moView full evidence