npm · registry.npmjs.org
xml-sanitizer
Credential file access: matched "NPM_TOKEN"
Why PkgRadar flagged 2.0.2
| Severity | Signal | Evidence |
|---|---|---|
| high | Credential file access | matched "NPM_TOKEN" · package/.github/workflows/create-release.yml |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
2.0.2 | Review | 30 | 2026-05-24 |
3.0.0 | Review | 30 | 2026-05-24 |
Related campaigns
- mylesborins — 3 releases, max score 60
- credential_paths:matched "NPM_TOKEN" — 76 releases, max score 2346
Block this in CI
pkgradar gate --ecosystem npm [email protected]