@redocly/openapi-core@2.36.0

One or more suspicious static signals were detected.

User imports or invokes Redocly OpenAPI lint/bundle/config APIs.

No evidence of credential harvesting, exfiltration, lifecycle mutation, persistence, or destructive behavior.

Package-aligned OpenAPI linting, bundling, schema metadata, and configured plugin loading

Static inspection shows a normal Redocly OpenAPI core library with no install hooks and no import-time malicious behavior. Scanner findings map to legitimate schema text, documentation URLs, and user-configured plugin mechanics rather than concrete malware.