Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@jetshop/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@jetshop/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Remote Payload: matched "cUrl "
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 18 · status changed
Evidence
Static findings
3 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/registerServiceWorker.js | matched "cUrl " | 12 |
Show all 3 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/registerServiceWorker.js | matched "cUrl " | 12 |
| low | Obfuscation | package/helpers/decodeUrlQuery.js | matched "Buffer.from(str, 'base64" | 3 |
| low | Obfuscation | package/components/Notifications/Notifications.js | matched "\\u00D7" | 3 |
Manifest
Package metadata
Scripts5
buildtsc --noEmit falsebuild-devrm -rf build && tsc --noEmit false --outDir build --module commonjs --target es2017prepackyarn buildpreversionyarn buildtestreact-scripts test
Dependencies43
@apollo/client~3.13.9@graphql-tools/delegate^7.1.2@graphql-tools/stitch^7.5.1@graphql-tools/wrap^7.0.5@loadable/component^5.11.0@loadable/server^5.16.0@sentry/browser^6.15.0@sentry/core^6.15.0@sentry/node^6.15.0@tanem/react-nprogress^5.0.44@xstate/react^0.8.1accept-language-parser^1.5.0apollo-server~2.6.9apollo-server-caching^0.4.0apollo-server-express~2.6.9compression^1.7.2dnscache^1.0.2eventemitter3^3.1.2express^4.16.3express-graphql^0.12.0fontfaceobserver^2.1.0format-message^6.2.4graphql^15.3.0immer^10.0.2intl^1.2.5isbot^3.6.12lodash.merge^4.6.1lodash.pick^4.4.0mobile-detect^1.4.4node-fetch^2.2.0- …and 13 more.