PkgRadar

npm · registry.npmjs.org

@tovex/toast

Remote Payload: matched "curl "

Why PkgRadar flagged 1.3.13

SeveritySignalEvidence
mediumRemote Payloadmatched "curl " · package/template/install-full.sh
mediumRemote Payloadmatched "curl " · package/template/install-macos.sh
mediumRemote Payloadmatched "curl " · package/template/uninstall-linux.sh
mediumRemote Payloadmatched "curl " · package/template/uninstall-macos.sh
mediumSuspicious Publish Context{"package_age_days":0,"publisher":"tovex","burst_same_day":2,"burst_week":3,"lure":null,"version_anomaly":false,"new_account":false}

Scanned versions

VersionVerdictScoreScanned (UTC)
1.3.13Review582026-06-15
1.3.12Review582026-06-15
1.3.11Review582026-06-15
1.3.10Review582026-06-15
1.3.9Review582026-06-15
1.3.8Review582026-06-15
1.3.7Review342026-06-15
1.3.6Review342026-06-15
1.3.5Review582026-06-15
1.3.4Review582026-06-15
1.3.3Review582026-06-15
1.3.2Review582026-06-15
1.3.1Review582026-06-15
1.3.0Review582026-06-15
1.2.8Review342026-06-15
1.2.7Review342026-06-15
1.2.6Review342026-06-15
1.2.5Review342026-06-15
1.2.4Review342026-06-15
1.2.3Review342026-06-15
1.2.2Review342026-06-15
1.2.1Review342026-06-15
1.1.1Review342026-06-15
1.2.0Review342026-06-15
1.1.0Review342026-06-15
1.0.0Review122026-06-15

Block this in CI

PkgRadar gates @tovex/toast (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @tovex/[email protected]
Start free — 25 scans / moView full evidence