PkgRadar

npm · registry.npmjs.org

clay-server

Remote Payload: matched "curl "

Why PkgRadar flagged 2.42.0

SeveritySignalEvidence
mediumRemote Payloadmatched "curl " · package/lib/os-users.js
mediumRemote Payloadmatched "raw.githubusercontent.com" · package/lib/project-http.js

Scanned versions

VersionVerdictScoreScanned (UTC)
2.42.0Review292026-06-08
2.41.0Review292026-06-08
2.42.0-beta.1Review292026-06-08
2.41.1-beta.1Review292026-05-30
2.41.1Review202026-05-30
2.40.0Review292026-05-30
2.40.1-beta.1Review292026-05-30
2.40.0-beta.2Review292026-05-30
2.40.0-beta.3Review202026-05-30
2.40.0-beta.1Review202026-05-30
2.39.0Review292026-05-30
2.39.0-beta.5Review292026-05-30
2.39.0-beta.4Review292026-05-30
2.39.0-beta.2Review292026-05-30
2.39.0-beta.3Review202026-05-30

Block this in CI

PkgRadar gates clay-server (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence