Package evidence

@sohantalukder/[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 12Established · −30% score
First published: Jul 2025
Publisher: sohantalukder

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@sohantalukder/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@sohantalukder/[email protected]"],"fail_on":"review"}'

Publishersohantalukder

Artifact bytes686,710

Previous version1.0.11

Published2025-09-23T07:18:23.971Z

SHA-25646ca965a8a0e19997884ee8881c632176c701e6eb5fe68139d676dd6d0f14129

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

8h agoLast checked

reviewRisk

8Score

1.0.12Version

Status history (1 event)

new → available8h ago · risk review · score 8 · status changed

Evidence

Static findings

1 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/template/build-release.sh	matched "curl "	12

Manifest

Package metadata

Scripts17

androidreact-native run-android
android:releasereact-native run-android --mode=release
build:androidcd android && ./gradlew assembleRelease
build:android:bundlecd android && ./gradlew bundleRelease
build:ioscd ios && xcodebuild -workspace ReactNativeTemplate.xcworkspace -scheme ReactNativeTemplate -configuration Release -destination generic/platform=iOS -archivePath ReactNativeTemplate.xcarchive archive
iosreact-native run-ios
ios:releasereact-native run-ios --mode=Release
lintyarn lint:rules && yarn lint:code-format && yarn lint:type-check
lint:code-formatprettier --check "{src,__mocks__}/**/*.{js,json,md,ts,tsx,yml,yaml}"
lint:fixyarn lint:rules --fix && yarn lint:code-format --write && yarn lint:type-check
lint:ruleseslint . --cache
lint:type-checktsc
pod-installnpx pod-install
preparehusky
startreact-native start
testjest
test:reportjest --collectCoverage --coverageDirectory="./coverage" --ci --reporters=default --reporters=jest-junit --coverage

Dependencies27

@d11/react-native-fast-image^8.6.3
@gorhom/bottom-sheet^5.2.6
@react-native-clipboard/clipboard^1.15.0
@react-native-community/netinfo^11.3.1
@react-native/new-app-screen0.80.1
@react-navigation/material-top-tabs^7.1.14
@react-navigation/native^7.1.14
@react-navigation/stack^7.4.2
@shopify/flash-list^1.8.3
@tanstack/react-query^5.81.5
axios^1.10.0
i18next^25.3.0
react19.1.0
react-error-boundary^6.0.0
react-i18next^15.5.3
react-native0.80.1
react-native-device-info^14.0.4
react-native-gesture-handler^2.27.1
react-native-mmkv^3.3.0
react-native-pager-view^6.4.1
react-native-reanimated^3.18.0
react-native-safe-area-context^5.5.1
react-native-screens^4.11.1
react-native-svg^15.12.0
react-native-webview^13.15.0
zod^3.25.67
zustand^5.0.6