PkgRadar

npm · registry.npmjs.org

oh-my-claude-sisyphus

Remote Payload: matched "raw.githubusercontent.com"

Why PkgRadar flagged 4.14.6

SeveritySignalEvidence
mediumRemote Payloadmatched "raw.githubusercontent.com" · package/dist/features/auto-update.js
mediumRemote Payloadmatched "api.telegram.org/bot" · package/dist/hooks/session-end/callbacks.js
mediumRemote Payloadmatched "curl " · package/skills/project-session-manager/lib/providers/bitbucket.sh
mediumRemote Payloadmatched "curl " · package/skills/project-session-manager/lib/providers/gitea.sh

Scanned versions

VersionVerdictScoreScanned (UTC)
4.14.6Review512026-06-09
4.14.5Review732026-06-04
4.14.4Review722026-05-26
4.14.3Review722026-05-26
4.14.1Review1462026-05-25
4.14.2Review1462026-05-25

Block this in CI

PkgRadar gates oh-my-claude-sisyphus (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence