PkgRadar

Package evidence

@zone-eu/[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
37Established · −30% score
First published
Oct 2025
Publisher
GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@zone-eu/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@zone-eu/[email protected]"],"fail_on":"review"}'
PublisherGitHub Actions
Artifact bytes3,159,886
Previous version1.49.3
Published2026-06-11T08:12:13.193Z
SHA-25649e4cf6a640cba429060fbea53bcd24fa635a453ed980cc36d6cb29d46424d07

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
28Score
1.49.4Version
Status history (1 event)
  1. new → available · risk review · score 28 · status changed

Evidence

Static findings

9 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/setup/01_install_commits.shmatched "curl "12
mediumRemote Payloadpackage/setup/04_install_import_keys.shmatched "curl "12
mediumRemote Payloadpackage/setup/05_install_packages.shmatched "wget "12
mediumRemote Payloadpackage/setup/13_install_ssl_certs.shmatched "wget "12
mediumRemote Payloadpackage/setup/15_install_deploy.shmatched "curl "12
mediumRemote Payloadpackage/setup/get_install.shmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/setup/install.shmatched "curl "12
Show all 9 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/setup/01_install_commits.shmatched "curl "12
mediumRemote Payloadpackage/setup/04_install_import_keys.shmatched "curl "12
mediumRemote Payloadpackage/setup/05_install_packages.shmatched "wget "12
mediumRemote Payloadpackage/setup/13_install_ssl_certs.shmatched "wget "12
mediumRemote Payloadpackage/setup/15_install_deploy.shmatched "curl "12
mediumRemote Payloadpackage/setup/get_install.shmatched "raw.githubusercontent.com"12
mediumRemote Payloadpackage/setup/install.shmatched "curl "12
lowCredential file accesspackage/setup/04_install_import_keys.shmatched ".ssh/"5
lowCredential file accesspackage/setup/15_install_deploy.shmatched ".ssh/"5

Manifest

Package metadata

Scripts10
  • apidocapidoc -i lib/api/ -o docs/api/
  • generate-api-docsGENERATE_API_DOCS=true REGENERATE_API_DOCS=true node server.js
  • printconfNODE_CONFIG_ONLY=true npm start
  • runcinpm run printconf && npm run runtest
  • runtestNODE_ENV=test grunt
  • showNODE_CONFIG_ONLY=true node server.js
  • startnode server.js
  • testmongosh --eval 'db.dropDatabase()' wildduck-test && redis-cli -n 13 flushdb && npm run runtest
  • test:protoNODE_ENV=test grunt proto
  • updaterm -rf node_modules package-lock.json && ncu -u && npm install
Dependencies64
  • @fidm/x5091.2.1
  • @opensearch-project/opensearch3.6.0
  • @phc/pbkdf21.1.14
  • @postalsys/vmc1.1.4
  • @root/acme3.1.0
  • @root/csr0.8.1
  • @zone-eu/mailsplit5.4.11
  • @zone-eu/mobileconfig2.4.6
  • @zone-eu/seq-index1.1.5
  • @zone-eu/smime-js0.1.0
  • @zone-eu/wild-config1.7.5
  • @zone-eu/wild-plugins1.0.6
  • @zone-eu/zone-mta3.10.16
  • accesscontrol2.2.1
  • axios1.16.1
  • base32.js0.1.0
  • bcryptjs3.0.3
  • bson7.2.0
  • bullmq5.77.3
  • fido2-lib3.5.9
  • gelf2.0.1
  • generate-password1.7.1
  • hash-wasm4.12.0
  • he1.2.0
  • html-to-text10.0.0
  • http-parser-js0.5.10
  • humanname0.2.2
  • iconv-lite0.7.2
  • ioredfour1.4.1
  • ioredis5.10.1
  • …and 34 more.