npm · registry.npmjs.org

@vaadin/bundles

Large Javascript Payload: 12175405 bytes

Why PkgRadar flagged 24.10.3

Severity	Signal	Evidence
medium	Large Javascript Payload	12175405 bytes · package/vaadin.js

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`25.2.0-beta2`	Low risk	0	2026-06-09
`24.10.4`	Low risk	0	2026-06-09
`24.9.16`	Low risk	0	2026-06-09
`25.1.4`	Low risk	0	2026-06-08
`25.0.13`	Low risk	0	2026-06-08
`24.10.3`	Review	10	2026-05-25
`25.2.0-beta1`	Review	10	2026-05-25

Block this in CI

PkgRadar gates @vaadin/bundles (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @vaadin/[email protected]