npm · registry.npmjs.org

xyvcard-mall-diy

Remote Payload: matched "cUrl "

Why PkgRadar flagged 0.0.50

Severity	Signal	Evidence
medium	Remote Payload	matched "cUrl " · package/dist/components/vcard/vcard-goods-category/goods-category-view/index.js
medium	Remote Payload	matched "cUrl " · package/dist/components/vcard/vcard-goods-hot/goods-hot-view/index.js

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.0.53`	Low risk	0	2026-06-02
`0.0.52`	Low risk	0	2026-05-31
`0.0.50`	Review	24	2026-05-24
`0.0.51`	Review	24	2026-05-24

Block this in CI

PkgRadar gates xyvcard-mall-diy (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]