PkgRadar

npm · registry.npmjs.org

@shopify/shop-minis-cli

Webhook Exfil Endpoint: matched "ngrok.app"

Why PkgRadar flagged 0.0.0-snapshot.20260612143512

SeveritySignalEvidence
highWebhook Exfil Endpointmatched "ngrok.app" · package/build/utils/vite-config.js

Scanned versions

VersionVerdictScoreScanned (UTC)
0.0.0-snapshot.20260612143512High risk132026-06-12
0.0.0-snapshot.20260611113556High risk132026-06-11
0.0.0-snapshot.20260209121751High risk122026-06-11
0.0.0-snapshot.20260209181247High risk122026-06-11
0.0.0-snapshot.20260206185112High risk122026-06-11
0.3.15Review132026-06-09
0.0.0-snapshot.20260609153401Review132026-06-09
0.3.14Review132026-06-05
0.0.0-snapshot.20260605142321Review132026-06-05
0.3.13Review132026-06-04
0.0.0-snapshot.20260603161039Review132026-06-03
0.0.0-snapshot.20260603135505Review132026-06-03
0.0.0-snapshot.20260603105031Review132026-06-03
0.0.0-snapshot.20260601180359Review132026-06-01
0.0.0-snapshot.20260601190027Review132026-06-01
0.0.0-snapshot.20260529082201Review132026-05-29
0.0.0-snapshot.20260521160740Review172026-05-28
0.3.12Review172026-05-28

Block this in CI

PkgRadar gates @shopify/shop-minis-cli (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @shopify/[email protected]
Start free — 25 scans / moView full evidence