Package evidence

@bufferapp/[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 11
Versions published: 191Mature · −50% score
First published: Dec 2017
Publisher: charmays

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@bufferapp/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@bufferapp/[email protected]"],"fail_on":"review"}'

Publishercharmays

Artifact bytes2,026,082

Previous version2.7.2

Published2020-04-03T19:23:16.029Z

SHA-25607a74cc6014e3573e57f759e6ecdadc1e8d7cb178f26de7fea7f084bbeb1c6a6

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

21d agoLast checked

reviewRisk

9Score

2.7.3Version

Status history (1 event)

new → available21d ago · risk review · score 9 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/.travis.yml	matched "curl "	12
medium	Large Javascript Payload	package/composer-web-iframe-bundle.ddf5e66cf47902d3928db8bc3a68815a.gz.js	3041210 bytes	10
medium	Large Javascript Payload	package/dist/composer-web-iframe-bundle.js	6640986 bytes	10

Manifest

Package metadata

Scripts11

compilerimraf dist/* && webpack --output-path=dist --config webpack.prod.config.js
compile-devrimraf dist/* && webpack --output-path=dist
lintecho "disabled command: eslint . --ignore-pattern coverage node_modules"
prepublishnpm run compile
startstart-storybook -p 9001 -c ./composer/.storybook
testyarn run lint && jest
test-updatejest -u
test-watchjest --watch
test-without-coverageyarn run lint && jest --coverage=false --collectCoverage=false
update-buffer-webnpm run compile && cp ./dist/* ../buffer-web/node_modules/@bufferapp/composer/dist && cd ../buffer-web && gulp webpack --app contentController
update-buffer-web-devnpm run compile-dev && cp ./dist/* ../buffer-web/node_modules/@bufferapp/composer/dist && cd ../buffer-web && gulp webpack --app contentController

Dependencies43

@bufferapp/buffer-js-api0.3.0
@bufferapp/buffer-js-metrics0.2.0
@bufferapp/buffer-js-request0.2.0
@bufferapp/components3.0.2
@bufferapp/draft-js0.10.1-fork.5
@bufferapp/draft-js-emoji-plugin^2.0.2
@bufferapp/draft-js-mention-plugin2.0.0-rc8.3
@bufferapp/draft-js-plugins-editor2.0.0-rc8.3
@bufferapp/dragme0.2.2
@bufferapp/react-images-loaded^1.1.0-fork.0
@bufferapp/react-simple-dropdown3.2.5
babel-cli^6.26.0
babel-core^6.26.0
decorate-component-with-props1.0.2
event-pubsub4.3.0
events1.1.1
fetch-jsonp1.0.3
flux2.1.1
immutable3.7.6
keymirror0.1.1
lodash.clonedeep4.3.2
lodash.debounce4.0.8
lodash.escaperegexp4.1.2
lodash.findlastindex4.6.0
lodash.partition4.6.0
lodash.throttle4.1.1
lodash.uniqby4.7.0
lru-cache4.0.2
moment^2.22.1
moment-timezone^0.5.25
…and 13 more.