PkgRadar

Package evidence

@bachi/[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
28
Versions published
7
First published
Jan 2026
Publisher
bachi

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@bachi/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@bachi/[email protected]"],"fail_on":"review"}'
Publisherbachi
Artifact bytes1,423,471
Previous version0.1.3
Published2026-05-13T11:10:14.328Z
SHA-256e2c3ab4873b9cf027b64c67a09518818e77537f279214475816074ae7c1fcfcd

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
12Score
0.1.4Version
Status history (1 event)
  1. new → available · risk review · score 12 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/module_sample/core_reload.jsmatched "curl "12

Manifest

Package metadata

Scripts8
  • buildwebNODE_ENV=production webpack --config web/webpack.config.js --colors
  • doc:build./build_scripts/build-doc-site.sh
  • doc:servenode build_scripts/prebuild-doc.js && gitbook serve ./docs-src ./docs --log debug
  • linteslint .
  • prepublishnpm run buildweb
  • testnpx jest
  • testservernode test/server/startServer.js
  • webserverNODE_ENV=test webpack --config web/webpack.config.js --colors --watch
Dependencies30
  • async~0.9.0
  • async-task-mgr>=1.1.0
  • body-parser^1.13.1
  • brotli^1.3.2
  • classnames^2.2.5
  • clipboard-js^0.3.3
  • co^4.6.0
  • colorful^2.1.0
  • commander~2.11.0
  • component-emitter^1.2.1
  • compression^1.4.4
  • es6-promise^3.3.1
  • express^4.8.5
  • fast-json-stringify^0.17.0
  • iconv-lite^0.4.6
  • inquirer^5.2.0
  • ip^0.3.2
  • juicer^0.6.6-stable
  • mime-types2.1.11
  • moment^2.15.1
  • nedb^1.8.0
  • node-easy-cert^1.0.0
  • pug^2.0.0-beta6
  • qrcode-npm0.0.3
  • request^2.74.0
  • stream-throttle^0.1.3
  • svg-inline-react^1.0.2
  • thunkify^2.1.2
  • whatwg-fetch^1.0.0
  • ws^5.1.0