Loading npm security reports…
The official CLI tool to manage the GraphQL Federation Platform Cosmo
Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/commands/router/commands/plugin/templates/typescript.jsView on unpkg · L4Package source references dynamic require/import behavior.
dist/src/commands/router/commands/plugin/templates/typescript.jsView on unpkg · L6Package source references a known benign dynamic code generation pattern.
dist/src/commands/router/commands/plugin/templates/typescript.jsView on unpkg · L11Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L9Package source references dynamic require/import behavior.
dist/src/commands/router/commands/plugin/templates/typescript.jsView on unpkg · L6A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/src/commands/router/commands/plugin/templates/typescript.jsView on unpkg · L4Package source references a known benign dynamic code generation pattern.
dist/src/commands/router/commands/plugin/templates/typescript.jsView on unpkg · L11Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/src/core/telemetry.jsView on unpkg · L9