Package evidence

@pattern-stack/[email protected]

Remote Payload: matched "curl "

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@pattern-stack/[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@pattern-stack/[email protected]"],"fail_on":"high"}'

Publisherdugsnodes

Artifact bytes1,995,514

Previous version0.7.8

Published2026-05-25T04:41:59.346Z

SHA-256f1dd3d3491c002d8ff0c6219a6f6f5eeb139a151c1805082f132273a4ede4f67

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

23d agoLast checked

highRisk

141Score

0.8.0Version

Status history (1 event)

new → available23d ago · risk high · score 141 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

dugsnodes

7 members · evidence strength 81

Evidence

Static findings

41 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/src/cli/index.js	matched "curl "	12
medium	Obfuscation Density	package/dist/src/cli/index.js	high encoded/escaped-token density	12

Show all 41 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/src/cli/index.js	matched "curl "	12
medium	Obfuscation Density	package/dist/src/cli/index.js	high encoded/escaped-token density	12
low	Obfuscation	package/dist/runtime/subsystems/analytics/analytics.module.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/auth/auth.module.js	matched "Buffer.from(raw, \"base64"	3
low	Obfuscation	package/dist/runtime/subsystems/bridge/bridge-delivery-handler.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/bridge/bridge-delivery.memory-backend.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/bridge/bridge-errors.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/bridge/bridge-outbox-drain-hook.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/bridge/bridge.module.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/sync/build-change-source.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/events/generated/bus.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/analytics/cube-backend.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/auth/backends/encryption-key/env.js	matched "Buffer.from(raw, \"base64"	3
low	Obfuscation	package/dist/runtime/subsystems/events/events-errors.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/events/events.module.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/sync/execute-sync.use-case.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/base-classes/index.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/analytics/index.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/auth/index.js	matched "Buffer.from(raw, \"base64"	3
low	Obfuscation	package/dist/runtime/subsystems/bridge/index.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/events/generated/index.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/events/index.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/index.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/jobs/index.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/sync/index.js	matched "\\u2014"	3
low	Obfuscation	package/dist/src/cli/index.js	matched "\\u001b"	3
low	Obfuscation	package/dist/src/index.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/jobs/job-handler.base.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/jobs/job-worker.module.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/jobs/jobs-errors.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/base-classes/junction-sync-repository.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/sync/poll-change-source.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/jobs/pool-config.loader.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/events/generated/registry.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/sync/sync-cursor-store.drizzle-backend.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/sync/sync-errors.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/sync/sync-run-recorder.drizzle-backend.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/sync/sync.module.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/base-classes/synced-entity-repository.js	matched "\\u2014"	3
low	Obfuscation	package/dist/runtime/subsystems/sync/webhook-change-source.js	matched "\\u2014"	3
low	Obfuscation	package/runtime/subsystems/auth/backends/encryption-key/env.ts	matched "Buffer.from(raw, 'base64"	3

Manifest

Package metadata

Scripts7

buildtsup
cdpbun src/cli/index.ts
prepublishOnlybun run build
testbun test/run-test.ts full
test:integrationbun test/scaffold/run-integration.ts
test:integration:quickbun test/scaffold/run-integration.ts --skip-codegen
typechecktsc --noEmit -p tsconfig.build.json

Dependencies11

@clack/prompts^0.7.0
chalk^5.6.2
clipanion^4.0.0-rc.4
drizzle-orm^0.45.2
glob^13.0.6
ora^9.3.0
pluralize^8.0.0
ts-morph^28.0.0
typescript^6.0.2
yaml^2.8.3
zod^3.22.4