PkgRadar

npm · registry.npmjs.org

shortcutxl

Remote Payload: matched "github.com/astral-sh/uv/releases/download"

Why PkgRadar flagged 0.3.63

SeveritySignalEvidence
mediumRemote Payloadmatched "github.com/astral-sh/uv/releases/download" · package/dist/startup/preflight/shared.js

Scanned versions

VersionVerdictScoreScanned (UTC)
0.3.63Review422026-06-10
0.3.61Review422026-06-05
0.3.60Review422026-06-04
0.3.59Review422026-06-03
0.3.58Review422026-06-03
0.3.57Review422026-06-03
0.3.56Review322026-05-30
0.3.54Review692026-05-27
0.3.55Review692026-05-27

Block this in CI

PkgRadar gates shortcutxl (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence
shortcutxl — npm security scan | PkgRadar