PkgRadar

Package evidence

@locofy/[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
157Mature · −50% score
First published
May 2024
Publisher
locofy

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@locofy/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@locofy/[email protected]"],"fail_on":"review"}'
Publisherlocofy
Artifact bytes672,917
Previous version0.0.160
Published2026-06-08T12:19:04.583Z
SHA-256ccda892e97315fdf8acb46cc66f2b06e2960b608a14b52ee1537ec414f88da8f

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
18Score
0.0.161Version
Status history (1 event)
  1. new → available · risk review · score 18 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/skills/enhance-execute/references/build-rn-ios.shmatched "curl "12
mediumRemote Payloadpackage/dist/skills/enhance-plan/references/build-rn-ios.shmatched "curl "12
mediumRemote Payloadpackage/dist/skills/agent-browser/references/setup-browser.shmatched "curl "12

Manifest

Package metadata

Scripts15
  • buildtsc && tsc-alias && cpy default-files dist && cpy 'src/agent/tool/tools/*.txt' dist/agent/tool/tools && cpy 'src/agent/integrate/gradle-wrapper/**/*' dist/agent/integrate/gradle-wrapper
  • build:minifynpm run build && npm run minify
  • bundle:skillsnode ./src/agent/skills/bundle.mjs
  • linkrimraf dist && npm run build && npm link
  • linteslint . --ext .ts --fix
  • minifynode scripts/minify.mjs
  • postbuildnpm run minify &&chmod +x dist/index.js
  • prebuildnpm run bundle:skills && node -e "const c=require('child_process').execSync('git rev-parse --short HEAD').toString().trim(); require('fs').writeFileSync('src/build-info.ts', '/** Auto-generated at build time. Do not edit manually. */\nexport const GIT_COMMIT = \x27'+c+'\x27;\n')"
  • pretestnpm run bundle:skills
  • testjest
  • test-angularjest tests/angular/ --no-coverage
  • test:swiftuinpx ts-node -r tsconfig-paths/register tests/swiftui/test-integration.ts
  • test:swiftui:allnpm run test:swiftui:types && npm run test:swiftui
  • test:swiftui:typesnpx ts-node tests/swiftui/test-type-decoder.ts
  • unlinknpm unlink @locofy/cli -g
Dependencies62
  • @angular/cli21.1.4
  • @babel/core^7.26.10
  • @babel/plugin-syntax-jsx^7.25.9
  • @babel/preset-env^7.26.0
  • @babel/preset-flow^7.27.1
  • @babel/preset-react^7.26.3
  • @babel/preset-typescript^7.27.0
  • @svgr/webpack^8.1.0
  • @tailwindcss/postcss~4.1.4
  • @vitejs/plugin-vue^6.0.4
  • adm-zip^0.5.16
  • archiver^7.0.1
  • autoprefixer^10.4.21
  • babel-loader^10.0.0
  • colors-cli^1.0.33
  • commander^13.1.0
  • css-loader^7.1.2
  • date-fns^4.1.0
  • dotenv^16.5.0
  • dotenv-webpack^8.1.0
  • enquirer^2.4.1
  • file-loader^6.2.0
  • form-data^4.0.4
  • html-element-attributes^3.4.0
  • inquirer^12.5.2
  • less^4.3.0
  • marked^15.0.12
  • marked-terminal^7.3.0
  • mime-types^3.0.1
  • mini-svg-data-uri^1.4.4
  • …and 32 more.
Optional dependencies2
  • tree-sitter^0.21.0
  • tree-sitter-kotlin^0.3.7