npm · registry.npmjs.org
create-merlin-brain
Remote Payload: matched "curl "
Why PkgRadar flagged 5.4.1
| Severity | Signal | Evidence |
|---|---|---|
| medium | Remote Payload | matched "curl " · package/files/merlin/analytics.sh |
| medium | Remote Payload | matched "curl " · package/files/loop/lib/blend.sh |
| medium | Remote Payload | matched "curl " · package/files/loop/lib/context.sh |
| medium | Remote Payload | matched "curl " · package/files/loop/merlin-session.sh |
| medium | Remote Payload | matched "curl " · package/files/hooks/post-edit-logger.sh |
| medium | Remote Payload | matched "curl " · package/files/hooks/pre-compact.sh |
| medium | Remote Payload | matched "curl " · package/files/hooks/pre-edit-sights-check.sh |
| medium | Remote Payload | matched "curl " · package/files/hooks/session-end-memory-sync.sh |
| medium | Remote Payload | matched "curl " · package/files/hooks/session-start.sh |
| medium | Remote Payload | matched "curl " · package/files/loop/lib/sights.sh |
| medium | Remote Payload | matched "curl " · package/files/loop/lib/state.sh |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
5.4.1 | Review | 50 | 2026-06-08 |
5.3.5 | Review | 50 | 2026-06-08 |
5.3.7 | Review | 50 | 2026-06-08 |
5.3.8 | Review | 50 | 2026-06-02 |
5.4.0 | Review | 50 | 2026-06-02 |
Block this in CI
pkgradar gate --ecosystem npm [email protected]