PkgRadar

npm · registry.npmjs.org

ulid-xyz

no static findings

Early detection

PkgRadar flagged this 11.7 days before public disclosure

Detected 2026-06-17 · disclosed as MAL-2026-6672 on 2026-06-29

Scanned versions

VersionVerdictScoreScanned (UTC)
3.2.2High risk02026-07-10
3.2.4Low risk02026-06-29
3.2.3Low risk02026-06-29
2.12.3Review352026-06-29
2.12.2Review452026-06-20
2.12.1Review452026-06-20
3.2.1Review102026-06-17
3.2.0Review102026-06-17
3.1.0Review102026-06-17

Block this in CI

PkgRadar gates ulid-xyz (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
ulid-xyz — npm malware advisory | PkgRadar