PkgRadar

Package evidence

@cyanautomation/[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
4,600Niche · −30% score
Versions published
105
First published
May 2026
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@cyanautomation/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@cyanautomation/[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes460,841
Previous version1.54.0
Published2026-05-27T22:53:08.387Z
SHA-256d02163369842d04fdeb290391e68b8b06e886e850713d382e76d0c5a946954c7

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
8Score
1.55.0Version
Status history (1 event)
  1. new → available · risk review · score 8 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/scripts/kaseki-container-setup-remote.shmatched "curl "12
mediumRemote Payloadpackage/scripts/kaseki-preflight.shmatched "curl "12
Show all 3 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/scripts/kaseki-container-setup-remote.shmatched "curl "12
mediumRemote Payloadpackage/scripts/kaseki-preflight.shmatched "curl "12
lowCredential file accesspackage/kaseki-agent.shmatched "GITHUB_TOKEN"5

Manifest

Package metadata

Scripts32
  • benchmark:pi-event-filternpm run build && RUN_PI_EVENT_FILTER_PERF=1 jest --testMatch "<rootDir>/perf/**/*.benchmark.test.ts" --runInBand
  • buildtsc && node dist/add-js-extensions.js && npm run generate:openapi && npm run check:dist-dynamic-imports && chmod 0755 dist/*.js
  • checknpm run type-check && npm run lint
  • check:dist-dynamic-importsnode dist/check-dist-dynamic-imports.js
  • generate:openapinode scripts/generate-openapi-spec.js
  • kaseki-apitsx src/kaseki-api-service.ts
  • lintnpm run lint:js && npm run lint:sh || true
  • lint:fixnpm run lint:js:fix && npm run lint:sh
  • lint:jseslint . src/ --ignore-pattern dist/
  • lint:js:fixeslint . src/ --fix --ignore-pattern dist/
  • lint:shshellcheck -x kaseki-agent.sh scripts/docker-entrypoint.sh run-kaseki-json.test.sh
  • lint:unusedeslint . src/ --ignore-pattern dist/ --rule 'unused-imports/no-unused-imports: error' --rule 'unused-imports/no-unused-vars: [error, {vars: all, varsIgnorePattern: ^_, args: after-used, argsIgnorePattern: ^_}]'
  • prepublishOnlynpm run build
  • releasesemantic-release
  • release:drysemantic-release --dry-run
  • testnpm run test:unit
  • test:cinpm run build && npm run type-check && jest --passWithNoTests && bash run-kaseki-json.test.sh && bash tests/allowlist-glob.test.sh && bash tests/restore-disallowed-changes.test.sh && bash tests/dependency-cache-key.test.sh && bash tests/dependency-restore-mode.test.sh && bash tests/doctor-template-parity.test.sh && bash tests/npm-install-flags.test.sh && bash tests/repo-memory.test.sh && bash tests/pre-agent-validation-order.test.sh && bash tests/scouting-order.test.sh && bash scripts/test-github-app.sh && bash tests/github-app-token-install-layout.test.sh && bash tests/github-preflight-helper-load.test.sh
  • test:clinpm run build && npm run test:cli:install && npm run test:cli:verify
  • test:cli:installnpm run test:cli:install-local && npm run test:cli:install-npx
  • test:cli:install-localnpm link && kaseki-agent --version && npm unlink -g @cyanautomation/kaseki-agent
  • test:cli:install-npxnpx . --version 2>&1 | grep -q 'version' && echo 'npx test passed'
  • test:cli:verifynpm run build && kaseki-agent --help && kaseki-agent doctor --help && kaseki-agent run --help && kaseki-agent list --help && kaseki-agent report --help && kaseki-agent status --help && kaseki-agent cancel --help
  • test:coveragejest --coverage
  • test:pack-artifactbash scripts/check-packed-artifact.sh
  • test:publish-smokenpm run build && npm run test:pack-artifact && npm pack --dry-run && node dist/cli.js --version && node dist/cli.js --help && node dist/cli.js doctor --help && node dist/cli.js run --help && node dist/cli.js list --help && node dist/cli.js report --help && node dist/cli.js status --help && node dist/cli.js cancel --help && npm run check:dist-dynamic-imports
  • test:unitjest --passWithNoTests
  • test:watchjest --watch
  • type-checktsc --noEmit -p tsconfig.json
  • type-check:changedtsc --noEmit -p tsconfig.changed.json
  • type-check:fullnpm run type-check
  • …and 2 more.
Dependencies5
  • @sentry/node^10.54.0
  • enquirer^2.4.1
  • express^4.18.2
  • swagger-ui-express^5.0.1
  • zod^3.22.4