PkgRadar

npm · registry.npmjs.org

trellis

Remote Payload: matched "curl "

Why PkgRadar flagged 3.1.26

SeveritySignalEvidence
mediumRemote Payloadmatched "curl " · package/dist/index-wt8rz4gn.js
mediumObfuscation Densityhigh encoded/escaped-token density · package/dist/cli/index.js
mediumRemote Payloadmatched "curl " · package/bin/trellis.mjs

Scanned versions

VersionVerdictScoreScanned (UTC)
1.0.2Low risk02026-06-12
3.2.3Low risk02026-06-12
3.2.2Low risk02026-06-10
1.0.1Low risk02026-06-10
1.0.4Low risk02026-06-10
1.0.6Low risk02026-06-10
3.2.0Low risk02026-06-09
3.1.35Low risk02026-05-30
3.1.34Low risk02026-05-30
3.1.33Low risk02026-05-30
3.1.31Low risk02026-05-28
3.1.30Low risk02026-05-27
3.1.26Review242026-05-24
3.1.20Review242026-05-24
3.1.15Review242026-05-24
3.1.19Review242026-05-24

Related campaigns

Block this in CI

PkgRadar gates trellis (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm [email protected]
Start free — 25 scans / moView full evidence