Package evidence

@blundergoat/[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 28
First published: Mar 2026
Publisher: blundergoat

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@blundergoat/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@blundergoat/[email protected]"],"fail_on":"review"}'

Publisherblundergoat

Artifact bytes796,763

Previous version1.6.4

Published2026-05-20T19:32:39.939Z

SHA-2566b230714cca4feaedcea51aa173cb0234766dcff026c256b96659f390f2fbb2d

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

14d agoLast checked

reviewRisk

38Score

1.7.0Version

Status history (2 events)

available → available14d ago · risk review · score 38 · status available -> available, risk high -> review, score 60 -> 38
new → available16d ago · risk high · score 60 · status changed

Evidence

Static findings

8 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/workflow/hooks/deny-dangerous.self-test.sh	matched "curl "	12

Show all 8 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/workflow/hooks/deny-dangerous.self-test.sh	matched "curl "	12
low	Credential file access	package/dist/cli/facts/agent/hooks.js	matched ".ssh/"	5
low	Credential file access	package/dist/cli/facts/agent/settings.js	matched ".ssh/"	5
low	Credential file access	package/workflow/hooks/deny-dangerous.self-test.sh	matched ".ssh/"	5
low	Install-time lifecycle script	package.json	postinstall="node scripts/warn-node-pty.mjs"	5
low	Credential file access	package/workflow/hooks/agent-config/claude.json	matched ".ssh/"	3
low	Credential file access	package/workflow/hooks/agent-config/gemini.json	matched ".ssh/"	3
low	Obfuscation Density	package/dist/dashboard/markdown-it.js	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts25

auditnode dist/cli/cli.js audit .
audit:harnessnode dist/cli/cli.js audit . --harness
audit:jsonnode dist/cli/cli.js audit . --format json
buildnode -e "require('node:fs').rmSync('dist', { recursive: true, force: true });" && tsc && node -e "require('node:fs').chmodSync('dist/cli/cli.js', 0o755);" && npm run build:dashboard
build:dashboardtsc -p tsconfig.dashboard.json && node scripts/build-dashboard-assets.mjs
check-instruction-paritynode scripts/check-instruction-parity.mjs
check-package-linksnode scripts/check-package-readme-links.mjs
check-versionsnode scripts/check-versions.mjs
dashboardnpm run build && node dist/cli/cli.js dashboard .
devtsc && npm run build:dashboard && node dist/cli/cli.js dashboard . --dev
formatprettier --write --no-error-on-unmatched-pattern "src/**/*.{ts,js,html}" "test/**/*.ts" "scripts/**/*.mjs"
format:checkprettier --check --no-error-on-unmatched-pattern "src/**/*.{ts,js,html}" "test/**/*.ts" "scripts/**/*.mjs"
goat-flow:clinode dist/cli/cli.js
postinstallnode scripts/warn-node-pty.mjs
preflightbash scripts/preflight-checks.sh
prepublishOnlynpm run build && npm run check-versions && npm run check-package-links
profile:dashboard-auditnode scripts/profile-dashboard-audit.mjs
skill-quality:snapshotnode --import tsx --input-type=module -e "import { writeFileSync } from 'node:fs'; import { scoreAllArtifacts } from './src/cli/quality/skill-quality.ts'; const fixture = Object.fromEntries(scoreAllArtifacts(process.cwd()).map((report) => { const pct = Math.round((report.totalScore / report.profileMax) * 100); return [report.artifact.id, { minPct: Math.max(0, pct - 2), maxPct: Math.min(100, pct + 2), recommendation: report.recommendation, subtype: report.subtype }]; })); writeFileSync('test/fixtures/skill-quality/expected-scores.json', JSON.stringify(fixture, null, 2) + '\n');"
testnpm run test:fast
test:coveragenode --import tsx --experimental-test-coverage --test --test-concurrency=8 $(find test -name '*.test.ts' ! -path 'test/integration/audit-drift.test.ts' ! -path 'test/integration/audit-quality.test.ts' ! -path 'test/integration/dashboard-server.test.ts' ! -path 'test/integration/quality-constraint-isolation.test.ts' ! -path 'test/unit/audit-harness/check-evidence-before-claims.test.ts' ! -path 'test/unit/dashboard-terminal-launch.test.ts' ! -path 'test/performance/*.test.ts' | sort)
test:fastnode --import tsx --test --test-concurrency=8 $(find test -name '*.test.ts' ! -path 'test/integration/audit-drift.test.ts' ! -path 'test/integration/audit-quality.test.ts' ! -path 'test/integration/dashboard-server.test.ts' ! -path 'test/integration/quality-constraint-isolation.test.ts' ! -path 'test/unit/audit-harness/check-evidence-before-claims.test.ts' ! -path 'test/unit/dashboard-terminal-launch.test.ts' ! -path 'test/performance/*.test.ts' | sort)
test:fullnpm run test:fast && npm run test:slow
test:performancenpm run build && GOAT_FLOW_PERF_TESTS=1 node --import tsx --test test/performance/*.test.ts
test:slownpm run build && node --import tsx --test test/integration/audit-drift.test.ts test/integration/audit-quality.test.ts test/integration/dashboard-server.test.ts test/integration/quality-constraint-isolation.test.ts test/unit/audit-harness/check-evidence-before-claims.test.ts test/unit/dashboard-terminal-launch.test.ts
typechecktsc --noEmit && tsc -p tsconfig.dashboard.json --noEmit

Dependencies3

js-yaml^4.1.0
markdown-it^14.1.1
ws^8.20.1

Optional dependencies1

node-pty1.1.0