PkgRadar

Package evidence

@descope/[email protected]

Remote Payload: matched "cUrl "

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@descope/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@descope/[email protected]"],"fail_on":"high"}'
Publisheromercnet
Artifact bytes77,282
Previous version0.24.11
Published2026-05-24T05:43:53.384Z
SHA-2560648fa46bd6b0ea712c394eb0a1ec6a095cd6aeef1e8a342fec92364ba91448e

Why flagged

What the scanner saw

Remote Payload: matched "cUrl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
96Score
0.25.0Version
Status history (1 event)
  1. new → available · risk high · score 96 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

omercnet

5 members · evidence strength 84

Evidence

Static findings

8 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/esm2022/lib/components/access-key-management/access-key-management.component.mjsmatched "cUrl "12
mediumRemote Payloadpackage/dist/esm2022/lib/components/applications-portal/applications-portal.component.mjsmatched "cUrl "12
mediumRemote Payloadpackage/dist/esm2022/lib/components/audit-management/audit-management.component.mjsmatched "cUrl "12
mediumRemote Payloadpackage/dist/fesm2022/descope-angular-sdk.mjsmatched "cUrl "12
mediumRemote Payloadpackage/dist/esm2022/lib/components/descope/descope.component.mjsmatched "cUrl "12
mediumRemote Payloadpackage/dist/esm2022/lib/components/role-management/role-management.component.mjsmatched "cUrl "12
mediumRemote Payloadpackage/dist/esm2022/lib/components/user-management/user-management.component.mjsmatched "cUrl "12
mediumRemote Payloadpackage/dist/esm2022/lib/components/user-profile/user-profile.component.mjsmatched "cUrl "12

Manifest

Package metadata

Scripts14
  • buildnpm run build:lib && rm -rf ./dist/package.json
  • build:appng build demo-app
  • build:libcp package.json ./projects/angular-sdk && ng build angular-sdk && rm -rf ./projects/angular-sdk/package.json
  • formatprettier . -w --ignore-path .gitignore
  • format-checkprettier . --check --ignore-path .gitignore
  • format-lintpretty-quick --staged --ignore-path .gitignore && lint-staged
  • lintng lint
  • ngng
  • posttestrm -rf ./projects/angular-sdk/package.json
  • prebuildnode scripts/setversion/setversion.js
  • pretestcp package.json ./projects/angular-sdk
  • startng serve
  • testjest --config jest.config.js
  • watchng build --watch --configuration development
Dependencies11
  • @descope/access-key-management-widget0.5.46
  • @descope/applications-portal-widget0.6.6
  • @descope/audit-management-widget0.6.8
  • @descope/core-js-sdk2.61.0
  • @descope/role-management-widget0.5.38
  • @descope/tenant-profile-widget0.5.37
  • @descope/user-management-widget0.11.26
  • @descope/user-profile-widget0.10.1
  • @descope/web-component3.63.0
  • @descope/web-js-sdk1.49.0
  • tslib^2.3.0