PkgRadar

npm · registry.npmjs.org

proyecto-cli

Credential file access: matched "GITHUB_TOKEN"

Why PkgRadar flagged 2.5.6

SeveritySignalEvidence
highCredential file accessmatched "GITHUB_TOKEN" · package/.goreleaser.yaml
highCredential file accessmatched "GITHUB_TOKEN" · package/.github/workflows/coverage.yml
highCredential file accessmatched "GITHUB_TOKEN" · package/.github/workflows/release.yml
mediumRemote Payloadmatched "github.com/robertwang1001/proyecto/releases/download" · package/.goreleaser.yaml

Scanned versions

VersionVerdictScoreScanned (UTC)
2.5.6Review502026-05-24
2.5.7Review502026-05-24

Block this in CI

PkgRadar gates proyecto-cli (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence
proyecto-cli — npm security scan | PkgRadar