Cargo · crates.io

vw-agent

Webhook Exfil Endpoint: matched "ngrok.app"

Why PkgRadar flagged 0.2.7

Severity	Signal	Evidence
high	Webhook Exfil Endpoint	matched "ngrok.app" · vw-agent-0.2.7/src/gateway/api/tests.rs
medium	Remote Payload	matched "curl " · vw-agent-0.2.7/src/agent/loop_/parsing/tool_call_formats_tests.rs
medium	Remote Payload	matched "Curl " · vw-agent-0.2.7/src/installation/mod.rs
medium	Remote Payload	matched "curl " · vw-agent-0.2.7/src/skills/audit/risk_tests.rs
medium	Remote Payload	matched "curl " · vw-agent-0.2.7/src/tools/schedule/tests.rs

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`0.2.7`	High risk	88	2026-06-06

Block this in CI

PkgRadar gates vw-agent (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem cargo [email protected]