npm · registry.npmjs.org
esm.sh
Remote Payload: matched "github.com/esm-dev/esm.sh/releases/download"
Why PkgRadar flagged 0.1.1
| Severity | Signal | Evidence |
|---|---|---|
| high | New Lifecycle Script Vs Previous | postinstall added in 0.1.1 vs 0.0.6: "node install.mjs" · package.json |
| medium | Remote Payload | matched "github.com/esm-dev/esm.sh/releases/download" · package/install.mjs |
| medium | Remote Payload | matched "github.com/esm-dev/esm.sh/releases/download" · package/bin/esm.sh |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
0.136.0 | Review | 14 | 2026-06-11 |
0.136.0-beta.10 | Review | 8 | 2026-06-11 |
0.136.0-beta.9 | Review | 8 | 2026-06-11 |
0.1.1 | High risk | 69 | 2026-06-11 |
Block this in CI
pkgradar gate --ecosystem npm [email protected]