PkgRadar

npm · registry.npmjs.org

tocco-devcon

Remote Payload: matched "Invoke-WebRequest"

Why PkgRadar flagged 3.16.14

SeveritySignalEvidence
mediumRemote Payloadmatched "Invoke-WebRequest" · package/dist/chunk-2456.29756bfca4b18c959ca6.js
mediumObfuscation Densityhigh encoded/escaped-token density · package/dist/chunk-2981.98c2ee360caaa7c33765.js
mediumObfuscation Densityhigh encoded/escaped-token density · package/dist/chunk-6335.470d01b24ae4bf68035b.js
mediumRemote Payloadmatched "cURL " · package/dist/chunk-7802.518ecb2a2b0c0a4f2d75.js
mediumRemote Payloadmatched "cURL " · package/dist/chunk-8077.1ddd76f2c7f821c3e4e1.js
mediumObfuscation Densityhigh encoded/escaped-token density · package/dist/ckeditor4/plugins/codemirror/js/beautify.min.js
mediumObfuscation Densityhigh encoded/escaped-token density · package/dist/ckeditor4/plugins/codemirror/js/codemirror.min.js
mediumRemote Payloadmatched "iwr " · package/dist/ckeditor4/plugins/placeholder/lang/cy.js

Scanned versions

VersionVerdictScoreScanned (UTC)
3.16.15Low risk02026-06-03
3.15.1-playgroundLow risk02026-06-03
3.16.14Review482026-05-25
3.15.0-playgroundReview482026-05-25
3.15.62Review482026-05-25

Block this in CI

PkgRadar gates tocco-devcon (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
tocco-devcon — npm security scan | PkgRadar