PkgRadar

npm · registry.npmjs.org

@agoric/cosmic-swingset

Remote Payload: matched "curl "

Why PkgRadar flagged 0.42.0

SeveritySignalEvidence
mediumRemote Payloadmatched "curl " · package/perf.sh

Scanned versions

VersionVerdictScoreScanned (UTC)
0.41.4-dev-3294e0c.0.3294e0cLow risk02026-06-11
0.42.0Review32026-06-10
0.41.4-dev-57c6564.0.57c6564Low risk02026-06-10
0.29.0Review32026-06-10
0.29.1Review32026-06-10
0.29.2Review32026-06-10
0.41.4-dev-9f5ae11.0.9f5ae11Low risk02026-06-03
0.41.4-dev-a1aec5d.0.a1aec5dLow risk02026-06-02
0.41.4-dev-6deecfc.0.6deecfcLow risk02026-06-02
0.41.4-dev-0e3d0e8.0.0e3d0e8Low risk02026-05-27
0.41.4-dev-159ee8a.0.159ee8aLow risk02026-05-25
0.41.4-dev-df17b1b.0.df17b1bLow risk02026-05-25
0.41.4-dev-925b831.0.925b831Low risk02026-05-25
0.41.4-dev-b0cb8c0.0.b0cb8c0Low risk02026-05-25

Block this in CI

PkgRadar gates @agoric/cosmic-swingset (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @agoric/[email protected]
Start free — 25 scans / moView full evidence