PkgRadar

Package evidence

@kkelly-offical/[email protected]

Remote Payload: matched "wget "

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@kkelly-offical/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@kkelly-offical/[email protected]"],"fail_on":"high"}'
Publisherkkellyoffical
Artifact bytes425,680
Previous version0.2.3
Published2026-05-24T16:07:53.023Z
SHA-2568f5f9bdc70003c6c1004908b501001818b3409bdcc209867683b0a0f09b2e5ac

Why flagged

What the scanner saw

Remote Payload: matched "wget "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
57Score
0.2.4-preview.1Version
Status history (1 event)
  1. newavailable · risk high · score 57 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

kkellyoffical

2 members · evidence strength 55

Evidence

Static findings

13 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/src/permission/exec-policy.mjsmatched "wget "12
mediumObfuscation Densitypackage/src/github/flow.mjshigh encoded/escaped-token density12
Show all 13 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/src/permission/exec-policy.mjsmatched "wget "12
mediumObfuscation Densitypackage/src/github/flow.mjshigh encoded/escaped-token density12
lowObfuscationpackage/src/ui/activity-renderer.mjsmatched "\\x1B"3
lowObfuscationpackage/src/github/auth.mjsmatched "\\x1b"3
lowObfuscationpackage/src/theme/color.mjsmatched "\\u001b"3
lowObfuscationpackage/src/repl/core-shell.mjsmatched "\\x1B"3
lowObfuscationpackage/src/github/flow.mjsmatched "\\x1b"3
lowObfuscationpackage/src/util/git.mjsmatched "\\u3040"3
lowObfuscationpackage/src/theme/markdown.mjsmatched "\\u2502"3
lowObfuscationpackage/src/commands/mcp.mjsmatched "\\uFEFF"3
lowObfuscationpackage/src/ui/repl-dashboard.mjsmatched "\\x1B"3
lowObfuscationpackage/src/repl.mjsmatched "\\x1B"3
lowObfuscationpackage/src/skill/builtin/security-checklist.mjsmatched "eval("3

Manifest

Package metadata

Scripts7
  • coveragenode ./scripts/run-node-tests.mjs --coverage
  • lintnode ./scripts/check-node-syntax.mjs
  • release:verifynode ./scripts/release-verify.mjs
  • startnode ./src/index.mjs
  • testnode ./scripts/run-node-tests.mjs
  • test:e2enode --test test/e2e/*.mjs
  • typechecknode ./scripts/check-types.mjs
Dependencies2
  • commander^13.1.0
  • yaml^2.8.2