PkgRadar

npm · registry.npmjs.org

curlbash

Install Lifecycle Remote Or Exec: postinstall="node -e \"const{join}=require('path');const{homedir}=require('os');const{mkdirSync,existsSync,copyFileSync,writeFileSync,readdirSync}=require('fs');const h=join(homedir(),'.curlbash');if(!existsSync(h))mkdirSync(h,{recursive:true});['scripts','data'].forEach(d=>{const p=join(h,d);if(!existsSync(p))mkdirSync(p,{recursive:true})});const s=join(__dirname,'scripts');if(existsSync(s))readdirSync(s).filter(f=>f.endsWith('.sh')).forEach(f=>{const t=join(h,'scripts',f);copyFileSync(join(s,f),t)});const e=join(h,'.env');if(!existsSync(e))writeFileSync(e,'PORT=3000\\nJWT_SECRET=curlbash-change-me\\n');console.log('✓ curlbash → '+h)\""

Why PkgRadar flagged 1.0.9

SeveritySignalEvidence
highInstall Lifecycle Remote Or Execpostinstall="node -e \"const{join}=require('path');const{homedir}=require('os');const{mkdirSync,existsSync,copyFileSync,writeFileSync,readdirSync}=require('fs');const h=join(homedir(),'.curlbash');if(!existsSync(h))mkdirSync(h,{recursive:true});['scripts','data'].forEach(d=>{const p=join(h,d);if(!existsSync(p))mkdirSync(p,{recursive:true})});const s=join(__dirname,'scripts');if(existsSync(s))readdirSync(s).filter(f=>f.endsWith('.sh')).forEach(f=>{const t=join(h,'scripts',f);copyFileSync(join(s,f),t)});const e=join(h,'.env');if(!existsSync(e))writeFileSync(e,'PORT=3000\\nJWT_SECRET=curlbash-change-me\\n');console.log('✓ curlbash → '+h)\"" · package.json
mediumNew Account With Lifecycle Hookpackage first published 7 day(s) ago, 10 total version(s), has lifecycle hook · package.json

Scanned versions

VersionVerdictScoreScanned (UTC)
1.0.9High risk352026-06-10
1.0.8High risk352026-06-10
1.0.7High risk352026-06-10
1.0.5High risk352026-06-10
1.0.6High risk352026-06-10

Campaign attribution

Part of the Clob dropper campaign.

Block this in CI

PkgRadar gates curlbash (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]