PkgRadar

npm · registry.npmjs.org

create-agentic-pdlc

Credential file access: matched "GITHUB_TOKEN"

Why PkgRadar flagged 2.2.1

SeveritySignalEvidence
highCredential file accessmatched "GITHUB_TOKEN" · package/bin/cli.js
highCredential file accessmatched "GITHUB_TOKEN" · package/.agentic-pdlc/templates/.github/workflows/agent-trigger.yml
highCredential file accessmatched "GITHUB_TOKEN" · package/.github/workflows/agent-trigger.yml
highCredential file accessmatched "GITHUB_TOKEN" · package/templates/.github/workflows/agent-trigger.yml
highCredential file accessmatched "GITHUB_TOKEN" · package/.agentic-pdlc/templates/.github/workflows/auto-approve.yml
highCredential file accessmatched "GITHUB_TOKEN" · package/.github/workflows/auto-approve.yml
highCredential file accessmatched "GITHUB_TOKEN" · package/templates/.github/workflows/auto-approve.yml
highCredential file accessmatched "GITHUB_TOKEN" · package/.agentic-pdlc/templates/.github/workflows/pdlc-stage-gate.yml
highCredential file accessmatched "GITHUB_TOKEN" · package/.github/workflows/pdlc-stage-gate.yml
highCredential file accessmatched "GITHUB_TOKEN" · package/templates/.github/workflows/pdlc-stage-gate.yml
highCredential file accessmatched "GITHUB_TOKEN" · package/.agentic-pdlc/templates/.github/workflows/qa-agent.yml
highCredential file accessmatched "GITHUB_TOKEN" · package/.github/workflows/qa-agent.yml

Scanned versions

VersionVerdictScoreScanned (UTC)
3.1.6Low risk02026-06-09
3.1.5Low risk02026-06-08
3.1.4Low risk02026-06-08
3.1.3Low risk02026-06-08
3.1.2Low risk02026-06-07
3.1.1Low risk02026-06-07
3.1.0Low risk02026-06-06
3.0.0Low risk02026-06-05
2.4.0Low risk02026-06-02
2.2.1Review862026-05-24
2.3.0Review862026-05-24

Block this in CI

PkgRadar gates create-agentic-pdlc (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence