Package evidence

[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published: 3,262Mature · −50% score
First published: Sep 2020
Publisher: neilguan

Effective trust discount applied: −50% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publisherneilguan

Artifact bytes2,868,206

Previous version1.0.1

Published2021-12-12T01:04:41.937Z

SHA-256ea6a28e5cd12271270d78dc39b2c7f27c3fdffd1b746b485b5ded32676d55015

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

15h agoLast checked

reviewRisk

8Score

1.0.2Version

Status history (1 event)

new → available15h ago · risk review · score 8 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/node_modules/@aws-cdk/cfnspec/build-tools/update-cfnlint.sh	matched "curl "	12
medium	Remote Payload	package/node_modules/@aws-cdk/cfnspec/build-tools/update.sh	matched "curl "	12

Show all 3 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/node_modules/@aws-cdk/cfnspec/build-tools/update-cfnlint.sh	matched "curl "	12
medium	Remote Payload	package/node_modules/@aws-cdk/cfnspec/build-tools/update.sh	matched "curl "	12
low	Credential file access	package/node_modules/@aws-cdk/core/.jsii.tabl.json	matched ".aws/"	3

Manifest

Package metadata

Scripts20

buildnpx projen build
bumpnpx projen bump
clobbernpx projen clobber
compatnpx projen compat
compilenpx projen compile
defaultnpx projen default
docgennpx projen docgen
eslintnpx projen eslint
packagenpx projen package
post-compilenpx projen post-compile
pre-compilenpx projen pre-compile
projennpx projen
releasenpx projen release
release:cdkv1npx projen release:cdkv1
testnpx projen test
test:updatenpx projen test:update
test:watchnpx projen test:watch
unbumpnpx projen unbump
upgradenpx projen upgrade
watchnpx projen watch

Dependencies11

@aws-cdk/assert^1.134.0
@aws-cdk/aws-ec2^1.134.0
@aws-cdk/aws-events^1.134.0
@aws-cdk/aws-events-targets^1.134.0
@aws-cdk/aws-iam^1.134.0
@aws-cdk/aws-lambda^1.134.0
@aws-cdk/aws-logs^1.134.0
@aws-cdk/aws-rds^1.134.0
@aws-cdk/core^1.134.0
@aws-cdk/custom-resources^1.134.0
constructs^3.3.165