npm · registry.npmjs.org
dw-kit
Credential file access: matched "GITHUB_TOKEN"
Why PkgRadar flagged 1.7.0-rc.2
| Severity | Signal | Evidence |
|---|---|---|
| high | Credential file access | matched "GITHUB_TOKEN" · package/.dw/config/dw.config.yml |
| high | Credential file access | matched "GITHUB_TOKEN" · package/.dw/config/presets/enterprise.yml |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
1.9.1 | Low risk | 0 | 2026-06-11 |
1.9.0 | Low risk | 0 | 2026-06-11 |
1.9.0-rc.1 | Low risk | 0 | 2026-05-28 |
1.8.0-rc.2 | Low risk | 0 | 2026-05-26 |
1.7.0-rc.2 | Review | 50 | 2026-05-24 |
1.8.0-rc.1 | Review | 50 | 2026-05-24 |
Related campaigns
- huygdv — 2 releases, max score 56
Block this in CI
pkgradar gate --ecosystem npm [email protected]