PkgRadar

npm · registry.npmjs.org

create-handzon

Credential File Packaged: package/dist/template/.env

Why PkgRadar flagged 0.9.1

SeveritySignalEvidence
highCredential File Packagedpackage/dist/template/.env · package/dist/template/.env

Scanned versions

VersionVerdictScoreScanned (UTC)
0.9.1High risk352026-06-13
0.7.2High risk352026-06-10
0.8.0High risk352026-06-10
0.9.0High risk352026-06-10

Block this in CI

PkgRadar gates create-handzon (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence