nuqs-codemod-runner

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). scripts/apply.sh invokes "npx --yes jscodeshift@latest", which at runtime fetches and executes the jscodeshift package from the npm registry (e.g. https://registry.npmjs.org/jscodeshift), so a remote package is fetched-and-run as a required dependency for the codemod pipeline.