PkgRadar

Package evidence

@thevinci/[email protected]

Remote Payload: matched "curl "

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@thevinci/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@thevinci/[email protected]"],"fail_on":"review"}'
Publisherjaygupta17
Artifact bytes8,596,427
Previous version1.0.3
Published2026-05-25T07:19:50.465Z
SHA-256b3b658aa46578c653fa9cd65f1fd4bbd9cc1e61f4cdcb1ebfff9cc84f9109586

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
183Score
1.0.4Version
Status history (1 event)
  1. new → available · risk review · score 183 · status changed

Evidence

Static findings

35 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/bin/cli.jsmatched "curl "12
mediumRemote Payloadpackage/server/lib/cloudflare-tunnel.jsmatched "cUrl "12
mediumRemote Payloadpackage/server/lib/tunnels/index.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/assets/OnboardingScreen-1fIy0izk.jsmatched "curl "12
mediumRemote Payloadpackage/server/lib/tunnels/routes.jsmatched "cUrl "12
mediumRemote Payloadpackage/server/lib/opencode/tunnel-auth.jsmatched "cUrl "12
mediumCredential file accesspackage/server/lib/skills-catalog/git.jsmatched ".ssh"10
mediumLarge Javascript Payloadpackage/dist/assets/modelPrefsAutoSave-z_3gcNaV.js2819035 bytes10
mediumLarge Javascript Payloadpackage/dist/assets/vendor-.bun-B9l0ZNi2.js18681413 bytes10
Show all 35 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/bin/cli.jsmatched "curl "12
mediumRemote Payloadpackage/server/lib/cloudflare-tunnel.jsmatched "cUrl "12
mediumRemote Payloadpackage/server/lib/tunnels/index.jsmatched "cUrl "12
mediumRemote Payloadpackage/dist/assets/OnboardingScreen-1fIy0izk.jsmatched "curl "12
mediumRemote Payloadpackage/server/lib/tunnels/routes.jsmatched "cUrl "12
mediumRemote Payloadpackage/server/lib/opencode/tunnel-auth.jsmatched "cUrl "12
mediumCredential file accesspackage/server/lib/skills-catalog/git.jsmatched ".ssh"10
mediumLarge Javascript Payloadpackage/dist/assets/modelPrefsAutoSave-z_3gcNaV.js2819035 bytes10
mediumLarge Javascript Payloadpackage/dist/assets/vendor-.bun-B9l0ZNi2.js18681413 bytes10
lowCredential file accesspackage/dist/assets/es-4o9ciP61.jsmatched ".ssh"5
lowCredential file accesspackage/server/lib/git/identity-storage.jsmatched ".ssh"5
lowCredential file accesspackage/server/lib/skills-catalog/install.jsmatched ".ssh"5
lowCredential file accesspackage/dist/assets/ko-B20imCHE.jsmatched ".ssh"5
lowCredential file accesspackage/dist/assets/MarkdownRendererImpl-Vl8hQ3Xn.jsmatched ".npmrc"5
lowCredential file accesspackage/dist/assets/pl-DQJ7LSzj.jsmatched ".ssh"5
lowCredential file accesspackage/dist/assets/pt-BR-OmjHUz9y.jsmatched ".ssh"5
lowCredential file accesspackage/server/lib/fs/routes.jsmatched ".ssh"5
lowCredential file accesspackage/server/lib/git/routes.jsmatched ".ssh"5
lowCredential file accesspackage/server/lib/github/routes.jsmatched ".ssh"5
lowCredential file accesspackage/server/lib/skills-catalog/scan.jsmatched ".ssh"5
lowCredential file accesspackage/server/lib/opencode/skill-routes.jsmatched ".ssh"5
lowCredential file accesspackage/dist/assets/uk-BNFxOlO4.jsmatched ".ssh"5
lowCredential file accesspackage/dist/assets/zh-CN-C6T-Ac7F.jsmatched ".ssh"5
lowObfuscationpackage/bin/cli.jsmatched "\\x1b"3
lowObfuscationpackage/server/lib/quota/providers/codex.jsmatched "\\u2014"3
lowObfuscationpackage/dist/assets/MarkdownRendererImpl-Vl8hQ3Xn.jsmatched "\\uFEFF"3
lowObfuscationpackage/server/lib/opencode/project-icon-routes.jsmatched "Buffer.from(base64, 'base64"3
lowObfuscationpackage/server/lib/git/service.jsmatched "\\x1f"3
lowObfuscationpackage/server/lib/terminal/terminal-ws-protocol.test.jsmatched "\\u001b"3
lowObfuscationpackage/dist/assets/TerminalView-CykGfmvO.jsmatched "fromCharCode"3
lowObfuscationpackage/dist/assets/ToolOutputDialog-BKJtJOAa.jsmatched "fromCharCode"3
lowObfuscationpackage/server/lib/ui-auth/ui-passkeys.jsmatched "Buffer.from(value, 'base64"3
lowObfuscationpackage/dist/assets/wasm-CG6Dc4jp.jsmatched "atob("3
lowObfuscationpackage/dist/assets/wasmSttWorker-oo7Dm_jy.jsmatched "fromCharCode"3
lowObfuscationpackage/dist/assets/worker-CbT6TVo7.jsmatched "\\uD800"3

Manifest

Package metadata

Scripts9
  • buildvite build
  • build:watchvite build --watch
  • devnpm run build:watch
  • dev:servernode server/index.js --port ${VINCI_PORT:-3901}
  • dev:server:watchnodemon --watch server --ext js --exec "node server/index.js --port ${VINCI_PORT:-3901}"
  • linteslint "./src/**/*.{ts,tsx}" --config ../../eslint.config.js
  • startnode bin/cli.js serve
  • testvitest run
  • type-checktsc --noEmit
Dependencies22
  • @clack/prompts^1.1.0
  • @octokit/rest^22.0.1
  • @opencode-ai/sdk^1.4.49
  • @simplewebauthn/server13.3.0
  • adm-zip^0.5.16
  • better-sqlite3^11.7.0
  • bun-pty^0.4.5
  • compression^1.8.1
  • cron-parser^4.9.0
  • express^5.1.0
  • http-proxy-middleware^3.0.5
  • jose^6.1.3
  • jsonc-parser^3.3.1
  • luxon^3.5.0
  • node-pty1.2.0-beta.12
  • openai^4.79.0
  • qrcode-terminal^0.12.0
  • reflect-metadata^0.2.2
  • simple-git^3.28.0
  • web-push^3.6.7
  • ws^8.18.3
  • yaml^2.8.1