PkgRadar

Composer · packagist.org

xhh125zl/express-api

Remote Payload: matched "curl "

Why PkgRadar flagged v2.0.3

SeveritySignalEvidence
mediumRemote Payloadmatched "curl " · xhh125zl-express-api-da54217/src/Common/HttpClient.php
mediumRemote Payloadmatched "curl " · xhh125zl-express-api-da54217/src/EMS/Auth.php

Scanned versions

VersionVerdictScoreScanned (UTC)
v2.0.3Review242026-05-30
v2.0.2Review242026-05-28
v2.0.0Review242026-05-27
v2.0.1Review242026-05-27

Block this in CI

PkgRadar gates xhh125zl/express-api (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem composer xhh125zl/[email protected]