npm · registry.npmjs.org
@flowfuse/device-agent
Remote Payload: matched "Invoke-WebRequest"
Why PkgRadar flagged 3.8.3
| Severity | Signal | Evidence |
|---|---|---|
| medium | Remote Payload | matched "Invoke-WebRequest" · package/installer/go/pkg/service/windows.go |
| medium | Remote Payload | matched "curl " · package/installer/get.sh |
| medium | Remote Payload | matched "curl\n " · package/service/raspbian-install-device-agent.sh |
| medium | Credential file access | matched ".npmrc" · package/lib/launcher.js |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
3.8.3 | Review | 23 | 2026-06-04 |
3.9.0 | Review | 17 | 2026-06-04 |
Block this in CI
pkgradar gate --ecosystem npm @flowfuse/[email protected]