PkgRadar

npm · registry.npmjs.org

vona-cli-set-api

Credential File Packaged: package/cli/templates/create/project/cabloy-basic/boilerplate/env/.env

Why PkgRadar flagged 1.1.5

SeveritySignalEvidence
highCredential File Packagedpackage/cli/templates/create/project/cabloy-basic/boilerplate/env/.env · package/cli/templates/create/project/cabloy-basic/boilerplate/env/.env
highCredential File Packagedpackage/cli/templates/create/project/cabloy-start/boilerplate/env/.env · package/cli/templates/create/project/cabloy-start/boilerplate/env/.env

Scanned versions

VersionVerdictScoreScanned (UTC)
1.1.110Low risk02026-06-16
1.1.109Low risk02026-06-13
1.1.5High risk352026-06-12
1.1.7High risk352026-06-12
1.1.106Low risk02026-06-12
1.1.98High risk352026-06-10
1.1.96High risk352026-06-10
1.1.97High risk352026-06-10
1.1.103Low risk02026-06-03
1.1.102Low risk02026-06-01
1.1.101Low risk02026-05-30
1.1.100Low risk02026-05-28

Block this in CI

PkgRadar gates vona-cli-set-api (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence