PkgRadar

Package evidence

@velocity-exchange/[email protected]

Remote Payload: matched "cUrl "

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@velocity-exchange/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@velocity-exchange/[email protected]"],"fail_on":"review"}'
Publisherillumenati
Artifact bytes2,163,754
Previous version0.0.1
Published2026-05-18T12:17:59.225Z
SHA-256ae38cf1266a674f29e82626bcf529f5eaaeb9115ee75502d924d3e33dc774363

Why flagged

What the scanner saw

Remote Payload: matched "cUrl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
113Score
0.0.2Version
Status history (1 event)
  1. new → available · risk review · score 113 · status changed

Evidence

Static findings

36 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/lib/browser/blockhashSubscriber/BlockhashSubscriber.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/node/blockhashSubscriber/BlockhashSubscriber.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/browser/priorityFee/priorityFeeSubscriber.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/node/priorityFee/priorityFeeSubscriber.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/browser/accounts/webSocketAccountSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/node/accounts/webSocketAccountSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/browser/accounts/webSocketProgramAccountsSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/node/accounts/webSocketProgramAccountsSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/browser/accounts/webSocketProgramAccountSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/node/accounts/webSocketProgramAccountSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/src/blockhashSubscriber/BlockhashSubscriber.tsmatched "cUrl "12
mediumRemote Payloadpackage/src/priorityFee/priorityFeeSubscriber.tsmatched "cUrl "12
mediumRemote Payloadpackage/src/accounts/webSocketAccountSubscriberV2.tsmatched "cUrl "12
mediumRemote Payloadpackage/src/accounts/webSocketProgramAccountsSubscriberV2.tsmatched "cUrl "12
mediumRemote Payloadpackage/src/accounts/webSocketProgramAccountSubscriberV2.tsmatched "cUrl "12
Show all 36 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/lib/browser/blockhashSubscriber/BlockhashSubscriber.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/node/blockhashSubscriber/BlockhashSubscriber.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/browser/priorityFee/priorityFeeSubscriber.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/node/priorityFee/priorityFeeSubscriber.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/browser/accounts/webSocketAccountSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/node/accounts/webSocketAccountSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/browser/accounts/webSocketProgramAccountsSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/node/accounts/webSocketProgramAccountsSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/browser/accounts/webSocketProgramAccountSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/lib/node/accounts/webSocketProgramAccountSubscriberV2.jsmatched "cUrl "12
mediumRemote Payloadpackage/src/blockhashSubscriber/BlockhashSubscriber.tsmatched "cUrl "12
mediumRemote Payloadpackage/src/priorityFee/priorityFeeSubscriber.tsmatched "cUrl "12
mediumRemote Payloadpackage/src/accounts/webSocketAccountSubscriberV2.tsmatched "cUrl "12
mediumRemote Payloadpackage/src/accounts/webSocketProgramAccountsSubscriberV2.tsmatched "cUrl "12
mediumRemote Payloadpackage/src/accounts/webSocketProgramAccountSubscriberV2.tsmatched "cUrl "12
lowObfuscationpackage/lib/browser/constituentMap/constituentMap.jsmatched "Buffer.from(programAccount.account.data[0], 'base64"3
lowObfuscationpackage/lib/node/constituentMap/constituentMap.jsmatched "Buffer.from(programAccount.account.data[0], 'base64"3
lowObfuscationpackage/lib/browser/jupiter/jupiterClient.jsmatched "Buffer.from(swapTransaction, 'base64"3
lowObfuscationpackage/lib/node/jupiter/jupiterClient.jsmatched "Buffer.from(swapTransaction, 'base64"3
lowObfuscationpackage/lib/browser/swift/swiftOrderSubscriber.jsmatched "Buffer.from(orderMessageRaw.order_signature, 'base64"3
lowObfuscationpackage/lib/node/swift/swiftOrderSubscriber.jsmatched "Buffer.from(orderMessageRaw.order_signature, 'base64"3
lowObfuscationpackage/lib/browser/userMap/userMap.jsmatched "Buffer.from(programAccount.account.data[0], 'base64"3
lowObfuscationpackage/lib/node/userMap/userMap.jsmatched "Buffer.from(programAccount.account.data[0], 'base64"3
lowObfuscationpackage/lib/browser/accounts/webSocketAccountSubscriberV2.jsmatched "Buffer.from(data, 'base64"3
lowObfuscationpackage/lib/node/accounts/webSocketAccountSubscriberV2.jsmatched "Buffer.from(data, 'base64"3
lowObfuscationpackage/lib/browser/accounts/webSocketProgramAccountsSubscriberV2.jsmatched "Buffer.from(data, 'base64"3
lowObfuscationpackage/lib/node/accounts/webSocketProgramAccountsSubscriberV2.jsmatched "Buffer.from(data, 'base64"3
lowObfuscationpackage/lib/browser/accounts/webSocketProgramAccountSubscriberV2.jsmatched "Buffer.from(data, 'base64"3
lowObfuscationpackage/lib/node/accounts/webSocketProgramAccountSubscriberV2.jsmatched "Buffer.from(data, 'base64"3
lowObfuscationpackage/src/constituentMap/constituentMap.tsmatched "Buffer.from(\n\t\t\t\t\t\t\tprogramAccount.account.data[0],\n\t\t\t\t\t\t\t'base64"3
lowObfuscationpackage/src/jupiter/jupiterClient.tsmatched "Buffer.from(swapTransaction, 'base64"3
lowObfuscationpackage/src/swift/swiftOrderSubscriber.tsmatched "Buffer.from(orderMessageRaw.order_signature, 'base64"3
lowObfuscationpackage/src/userMap/userMap.tsmatched "Buffer.from(\n\t\t\t\t\t\tprogramAccount.account.data[0],\n\t\t\t\t\t\t'base64"3
lowObfuscationpackage/src/accounts/webSocketAccountSubscriberV2.tsmatched "Buffer.from(data, 'base64"3
lowObfuscationpackage/src/accounts/webSocketProgramAccountsSubscriberV2.tsmatched "Buffer.from(data, 'base64"3
lowObfuscationpackage/src/accounts/webSocketProgramAccountSubscriberV2.tsmatched "Buffer.from(data, 'base64"3

Manifest

Package metadata

Scripts18
  • buildbun run clean && tsc -p tsconfig.json && tsc -p tsconfig.browser.json && node scripts/postbuild.js
  • build:browserbun run clean && tsc -p tsconfig.json && tsc -p tsconfig.browser.json && node scripts/postbuild.js --force-env browser
  • build:minifynode build-browser.js
  • circular-depsbunx madge --circular --circular --extensions ts src
  • cleanrm -rf lib
  • linteslint './**/*.{ts,tsx}' --quiet --format unix
  • patch-and-pubnpm version patch --force && npm publish
  • prettifyprettier --check './src/***/*.ts'
  • prettify:fixprettier --write './{src,tests}/***/*.ts'
  • testmocha -r ts-node/register tests/**/*.ts --ignore 'tests/dlob/**/*.ts'
  • test:bignummocha -r ts-node/register tests/bn/**/*.ts
  • test:cimocha -r ts-node/register tests/ci/**/*.ts
  • test:dlobmocha -r ts-node/register tests/dlob/**/*.ts
  • test:driftcorebun test tests/DriftCore
  • test:eventsmocha -r ts-node/register tests/events/**/*.ts
  • test:inspectmocha --inspect-brk -r ts-node/register tests/**/*.ts
  • test:matchmocha -r ts-node/register --ignore 'tests/dlob/**/*.ts'
  • versionnode ./scripts/updateVersion.js
Dependencies22
  • @anchor-lang/core1.0.1
  • @coral-xyz/anchornpm:@anchor-lang/[email protected]
  • @coral-xyz/anchor-29npm:@coral-xyz/[email protected]
  • @msgpack/msgpack3.1.2
  • @pythnetwork/client2.5.3
  • @pythnetwork/price-service-sdk1.7.1
  • @pythnetwork/pyth-lazer-sdk6.0.0
  • @solana/spl-token0.4.13
  • @solana/web3.js1.98.0
  • @triton-one/yellowstone-grpc5.0.5
  • anchor-bankrun0.5.0
  • gill0.10.2
  • nanoid3.3.4
  • node-cache5.1.2
  • solana-bankrun0.4.0
  • strict-event-emitter-types2.0.0
  • tweetnacl1.0.3
  • tweetnacl-util0.15.1
  • uuid8.3.2
  • yargs17.7.2
  • zod4.0.17
  • zstddec0.1.0
Optional dependencies1
  • helius-laserstream0.1.8