PkgRadar

PyPI · pypi.org

pipulate

Remote Payload: matched "curl "

Why PkgRadar flagged 1.89

SeveritySignalEvidence
mediumRemote Payloadmatched "curl " · pipulate-1.89/apps/050_documentation.py
mediumRemote Payloadmatched "cURL " · pipulate-1.89/apps/120_link_graph.py
mediumRemote Payloadmatched "Curl " · pipulate-1.89/apps/400_botify_trifecta.py
mediumRemote Payloadmatched "Curl " · pipulate-1.89/apps/xx_link_graph_v2.py
mediumRemote Payloadmatched "curl " · pipulate-1.89/cli.py
mediumRemote Payloadmatched "cURL " · pipulate-1.89/pipulate/core.py
mediumRemote Payloadmatched "curl " · pipulate-1.89/server.py

Scanned versions

VersionVerdictScoreScanned (UTC)
1.99Low risk02026-06-08
1.98Low risk02026-06-04
1.97Low risk02026-06-04
1.96Low risk02026-06-04
1.95Low risk02026-06-02
1.94Low risk02026-06-02
1.93Low risk02026-06-02
1.92Low risk02026-06-02
1.91Low risk02026-06-02
1.90Low risk02026-06-01
1.89Review252026-05-27

Block this in CI

PkgRadar gates pipulate (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem pypi pipulate==1.89