PkgRadar

npm · registry.npmjs.org

crowpus

Webhook Exfil Endpoint: matched "ngrok-free.app"

Why PkgRadar flagged 2026.5.26

SeveritySignalEvidence
highWebhook Exfil Endpointmatched "ngrok-free.app" · package/dist/extensions/voice-call/index.js
highWebhook Exfil Endpointmatched "ngrok.app" · package/dist/zalo-js-D2x13xjL.js

Scanned versions

VersionVerdictScoreScanned (UTC)
2026.5.26High risk1202026-06-10
2026.4.10-2High risk1202026-06-10
2026.6.6High risk1202026-06-10
2026.5.31-1.0.1High risk1202026-06-10
2026.5.31-1.0.0High risk1202026-06-10
2026.5.31High risk1202026-06-10

Block this in CI

PkgRadar gates crowpus (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence