PkgRadar

Package evidence

@antseed/[email protected]

Remote Payload: matched "curl "

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@antseed/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@antseed/[email protected]"],"fail_on":"high"}'
Publishershahafan
Artifact bytes213,532
Previous version0.1.121
Published2026-05-17T23:26:32.564Z
SHA-256e4a31e5baf5f6d9d38e5f827b2b0cc1a44102900eef2dd2d1022b8f65357a490

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
75Score
0.1.122Version
Status history (1 event)
  1. new → available · risk high · score 75 · status changed

Evidence

Static findings

7 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/cli/commands/network/browse.jsmatched "curl "12
mediumRemote Payloadpackage/dist/cli/payment-utils.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/cli/commands/network/peer.jsmatched "curL "12
mediumRemote Payloadpackage/dist/cli/commands/seller/setup.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/cli/commands/seller/setup.test.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/cli/commands/seller/start.jsmatched "cUrl "12
Show all 7 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/cli/commands/network/browse.jsmatched "curl "12
mediumRemote Payloadpackage/dist/cli/payment-utils.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/cli/commands/network/peer.jsmatched "curL "12
mediumRemote Payloadpackage/dist/cli/commands/seller/setup.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/cli/commands/seller/setup.test.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/cli/commands/seller/start.jsmatched "cUrl "12
lowObfuscationpackage/dist/cli/commands/identity/profile.jsmatched "\\u2500"3

Manifest

Package metadata

Scripts9
  • buildtsc
  • build:bundleesbuild src/cli/index.ts --bundle --platform=node --format=esm --outfile=dist/bundle.mjs --external:better-sqlite3 --external:node-datachannel --external:koffi --external:keytar --banner:js='#!/usr/bin/env node'
  • devtsx watch src/cli/index.ts
  • postbuildnode ../../scripts/fix-executable.mjs dist/cli/index.js
  • prebuildnode ../../scripts/remove-paths.mjs dist
  • start:connectnode dist/cli/index.js connect
  • start:seednode dist/cli/index.js seed
  • testnpm run build && node --test dist/config/*.test.js dist/cli/commands/**/*.test.js dist/proxy/*.test.js dist/plugins/*.test.js
  • typechecktsc --noEmit
Dependencies11
  • @antseed/ant-agent0.1.34
  • @antseed/api-adapter0.1.39
  • @antseed/node0.2.87
  • @antseed/payments0.1.21
  • @antseed/provider-core0.2.49
  • chalk^5.6.2
  • cli-table3^0.6.5
  • commander^14.0.3
  • dotenv^16.6.1
  • open^11.0.0
  • ora^9.3.0