Package evidence

[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 1
First published: Jun 2026
Publisher: lucy.cl

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherlucy.cl

Artifact bytes1,588,108

Previous versionnone

Published2026-06-13T08:00:05.844Z

SHA-256ba23809643d1230541dc4f056e3c68f0b72fe2279a22565a0d14f8fb8a3436a6

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

11h agoLast checked

reviewRisk

42Score

1.0.0-beta.0Version

Status history (1 event)

new → available11h ago · risk review · score 42 · status changed

Evidence

Static findings

10 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/extensions/builtin/browser/src/browser_harness/admin.py	matched "curl "	12
medium	Suspicious Publish Context	manifest	{"package_age_days":0,"publisher":"lucy.cl","burst_same_day":2,"burst_week":2,"lure":null,"version_anomaly":false,"new_account":false}	10

Show all 10 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/extensions/builtin/browser/src/browser_harness/admin.py	matched "curl "	12
medium	Suspicious Publish Context	manifest	{"package_age_days":0,"publisher":"lucy.cl","burst_same_day":2,"burst_week":2,"lure":null,"version_anomaly":false,"new_account":false}	10
low	Credential file access	package/dist/cli/args.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/dist/core/lib/ai/src/env-api-keys.js	matched "GOOGLE_APPLICATION_CREDENTIALS"	5
low	Credential file access	package/dist/node_modules/@catui/ai/dist/env-api-keys.js	matched "GOOGLE_APPLICATION_CREDENTIALS"	5
low	Credential file access	package/dist/extensions/builtin/security-audit/interface.js	matched ".ssh/"	5
low	Obfuscation Density	package/dist/extensions/builtin/grub/grub-controller.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/extensions/builtin/grub/grub-i18n.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/extensions/builtin/presence/index.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/dist/modes/interactive/components/soul-stats.js	high encoded/escaped-token density	0

Manifest

Package metadata

Scripts42

benchmarknode scripts/startup-benchmark.cjs
benchmark:comparenode scripts/startup-benchmark.cjs --baseline .benchmarks/baseline.json
benchmark:savenode scripts/startup-benchmark.cjs --output .benchmarks/baseline.json
buildnpm run clean:dist && npm run build:deps && tsc -p tsconfig.build.json && npm run copy:internal-libs && npm run copy:theme:json && npm run copy:assets && npm run build:meta && npm run minify:dist
build:depsnode scripts/build-deps.js
build:metanode scripts/generate-build-meta.js
build:releasenpm run generate-models --prefix core/lib/ai && npm run build
changelognode scripts/generate-changelog.js
clean:distnode -e "require('fs').rmSync('dist',{recursive:true,force:true})"
copy:assetsnode scripts/copy-assets.js
copy:internal-libsnode scripts/copy-internal-libs.js
copy:theme:jsonnode -e "const fs=require('fs');const p=require('path');const d='dist/modes/interactive/theme';if(!fs.existsSync(d))fs.mkdirSync(d,{recursive:true});fs.readdirSync('modes/interactive/theme').forEach(f=>{if(f.endsWith('.json'))fs.copyFileSync(p.join('modes/interactive/theme',f),p.join(d,f))})"
devtsx cli.ts
minify:distnode scripts/minify-dist.js
postversiongit push
preparegit config core.hooksPath .githooks || true
prepublishOnlynpm run build:release
releasenpm version patch && npm publish
scaffold:docsnode --import tsx scripts/scaffold-feature-docs.ts
startnpx cross-env NODE_ENV=production node --no-deprecation dist/cli.js
test:commandsnode --test --import tsx test/slash-command-catalog.test.ts test/extension-command-completions.test.ts test/interactive-slash-command-arguments.test.ts test/rpc-command-catalog.test.ts
test:interactive-memory-notifynode --test --import tsx test/interactive-memory-notify.test.ts test/session-manager-header.test.ts
test:plannode --test --import tsx test/plan-mode.test.ts
test:presencenode --test --import tsx test/presence-opening.test.ts
test:securitynode --test --import tsx test/security-audit.test.ts
test:subagentnode --test --import tsx test/subagent-parser.test.ts test/worktree-manager.test.ts test/bash-sandbox.test.ts
test:teamnode --test --import tsx test/team-parser.test.ts test/team-runtime.test.ts
test:toolsnode --test --import tsx test/workspace-write-guard.test.ts test/read-tool.test.ts test/tool-window-validation.test.ts test/bash-sandbox.test.ts
test:utilsnode --test --import tsx test/logger.test.ts
update-modelsnpm run generate-models --prefix core/lib/ai
…and 12 more.

Dependencies40

@agentclientprotocol/sdk^0.16.1
@anthropic-ai/sdk^0.73.0
@aws-sdk/client-bedrock-runtime^3.983.0
@google/genai^1.40.0
@mariozechner/clipboard^0.3.2
@mariozechner/jiti^2.6.2
@mistralai/mistralai1.10.0
@silvia-odwyer/photon-node^0.3.4
@sinclair/typebox^0.34.41
ajv^8.17.1
ajv-formats^3.0.1
catui-mem^1.1.2
catui-protocol^0.1.1
catui-soul^0.1.0
chalk^5.5.0
chokidar^5.0.0
cli-highlight^2.1.11
diff^8.0.2
extract-zip^2.0.1
file-type^21.1.1
get-east-asian-width^1.3.0
glob^13.0.1
hosted-git-info^9.0.2
ignore^7.0.5
marked^15.0.12
mime-types^3.0.1
minimatch^10.1.1
openai6.10.0
partial-json^0.1.7
pdf-lib^1.17.1
…and 10 more.

Optional dependencies1

koffi^2.9.0