PkgRadar

Package evidence

[email protected]

Remote Payload: matched "curl "

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisheryabafre
Artifact bytes515,866
Previous version6.12.1
Published2026-05-22T16:54:45.736Z
SHA-256cf811d07b24a0b021e084015a77213c745bfb3c5a44e6c5136493228fe659a0f

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
33Score
6.12.2Version
Status history (1 event)
  1. new → available · risk review · score 33 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/src/bash-safety.jsmatched "curl "12
mediumRemote Payloadpackage/src/templates/hooks/safe-bash.jsmatched "curl "12
Show all 5 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/src/bash-safety.jsmatched "curl "12
mediumRemote Payloadpackage/src/templates/hooks/safe-bash.jsmatched "curl "12
lowObfuscationpackage/bin/aped-method.jsmatched "\\x1b"3
lowObfuscationpackage/src/templates/scripts.jsmatched "\\x27"3
lowObfuscationpackage/src/templates/scripts/statusline.jsmatched "\\x1b"3

Manifest

Package metadata

Scripts7
  • checknode --check bin/aped-method.js && node --check src/*.js && node --check src/templates/*.js && node --check src/templates/hooks/*.js && node --check src/templates/providers/*.js && node --check src/templates/scripts/*.js && node --check src/templates/mcp/*.mjs && node --check scripts/smoke-pack.js && node --check scripts/gen-skill-docs.mjs
  • gen:skill-docsnode scripts/gen-skill-docs.mjs
  • gen:skill-docs:checknode scripts/gen-skill-docs.mjs --check
  • prepublishOnlynpm run gen:skill-docs:check && npm run check && npm run smoke && npm test
  • smokenode bin/aped-method.js --version && node bin/aped-method.js --help > /dev/null && node scripts/smoke-pack.js
  • testvitest run
  • test:watchvitest
Dependencies2
  • @clack/prompts^1.2.0
  • picocolors^1.1.1