npm · registry.npmjs.org
@fishawack/lab-env
Remote Payload: matched "curl "
Why PkgRadar flagged 5.7.0-beta.2
| Severity | Signal | Evidence |
|---|---|---|
| medium | Remote Payload | matched "curl " · package/commands/create/services/egnyte.js |
| medium | Remote Payload | matched "curl " · package/commands/create/services/gitlab.js |
| medium | Remote Payload | matched "curl " · package/commands/origin.js |
| medium | Remote Payload | matched "curl " · package/commands/create/templates/elasticbeanstalk/.platform/hooks/predeploy/deactivate-plugins.sh |
| medium | Remote Payload | matched "curl " · package/_Scripts/post-release.sh |
| medium | Credential file access | matched ".ssh/" · package/commands/create/services/guide.js |
| medium | Credential file access | matched ".ssh/" · package/commands/create/services/test.js |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
5.7.0-beta.2 | Review | 27 | 2026-06-11 |
5.7.0-beta.1 | Review | 27 | 2026-06-08 |
5.6.1 | Review | 29 | 2026-06-03 |
5.5.0 | Review | 29 | 2026-06-03 |
5.6.1-beta.1 | Review | 29 | 2026-06-03 |
Block this in CI
pkgradar gate --ecosystem npm @fishawack/[email protected]