NuGet · nuget.org

curlimpersonate

Remote Payload: matched "curl "

Why PkgRadar flagged 1.0.0-alpha.2

Severity	Signal	Evidence
medium	Remote Payload	matched "curl " · CurlImpersonate.nuspec
medium	Large Native Blob	5257136 bytes · runtimes/linux-arm64/native/libcurl_shim.so
medium	Large Native Blob	5255480 bytes · runtimes/linux-musl-arm64/native/libcurl_shim.so
medium	Large Native Blob	5968280 bytes · runtimes/linux-musl-x64/native/libcurl_shim.so
medium	Large Native Blob	5941168 bytes · runtimes/linux-x64/native/libcurl_shim.so
medium	Large Native Blob	5912080 bytes · runtimes/osx-arm64/native/libcurl_shim.dylib
medium	Large Native Blob	6445088 bytes · runtimes/osx-x64/native/libcurl_shim.dylib

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`1.0.0-alpha.2`	Review	72	2026-06-12

Block this in CI

PkgRadar gates curlimpersonate (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem nuget [email protected]