PkgRadar

npm · registry.npmjs.org

@geraldmaron/construct

Remote Payload: matched "curl "

Why PkgRadar flagged 1.0.24

SeveritySignalEvidence
mediumRemote Payloadmatched "curl " · package/lib/mcp-manager.mjs
mediumRemote Payloadmatched "curl " · package/lib/runtime/uv-bootstrap.mjs
mediumRemote Payloadmatched "curl " · package/templates/distribution/bootstrap.sh

Scanned versions

VersionVerdictScoreScanned (UTC)
1.0.24Review122026-06-09
1.0.23Review122026-06-08
1.0.21Review122026-06-04
1.0.20Review122026-06-03
1.0.19Review122026-06-03
1.0.18Review122026-06-03
1.0.17Review122026-06-02
1.0.16Review122026-06-01
1.0.15Review122026-06-01
1.0.14Review122026-05-31
1.0.11Review272026-05-28
1.0.12Review272026-05-28
1.0.9Review272026-05-28
1.0.10Review272026-05-28
1.0.8Review272026-05-28
1.0.6Review272026-05-28
1.0.7Review272026-05-28

Block this in CI

PkgRadar gates @geraldmaron/construct (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @geraldmaron/[email protected]
Start free — 25 scans / moView full evidence