PkgRadar

Package evidence

[email protected]

Remote Payload: matched "cUrl "

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'
Publisherwangenius
Artifact bytes1,305,612
Previous version1.0.523
Published2026-05-12T02:42:45.838Z
SHA-2567632c9349330c6faff1aa9375980fd8f31c22bce013edea585391de6471e9e3b

Why flagged

What the scanner saw

Remote Payload: matched "cUrl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high
Last checked
highRisk
111Score
1.0.526Version
Status history (1 event)
  1. new → available · risk high · score 111 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

wangenius

9 members · evidence strength 84

Evidence

Static findings

22 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/bin/main/modules/cli/Console.jsmatched "cUrl "12
mediumRemote Payloadpackage/bin/services/contact/runtime/EndpointResolver.jsmatched "cUrl "12
mediumRemote Payloadpackage/bin/main/modules/cli/PortHints.jsmatched "cUrl "12
mediumRemote Payloadpackage/test/main/cli-port-hints.test.mjsmatched "cUrl "12
mediumRemote Payloadpackage/test/contact/contact-runtime.test.mjsmatched "cUrl "12
Show all 22 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/bin/main/modules/cli/Console.jsmatched "cUrl "12
mediumRemote Payloadpackage/bin/services/contact/runtime/EndpointResolver.jsmatched "cUrl "12
mediumRemote Payloadpackage/bin/main/modules/cli/PortHints.jsmatched "cUrl "12
mediumRemote Payloadpackage/test/main/cli-port-hints.test.mjsmatched "cUrl "12
mediumRemote Payloadpackage/test/contact/contact-runtime.test.mjsmatched "cUrl "12
lowObfuscationpackage/bin/services/chat/channels/telegram/ApiClient.jsmatched "\\u4e00"3
lowObfuscationpackage/public/app.jsmatched "\\u00C0"3
lowObfuscationpackage/bin/shared/utils/store/crypto.jsmatched "Buffer.from(raw, \"base64"3
lowObfuscationpackage/bin/main/modules/console/EnvApiRoutes.jsmatched "\\uFEFF"3
lowObfuscationpackage/bin/main/modules/http/dashboard/ExecuteInput.jsmatched "Buffer.from(base64, \"base64"3
lowObfuscationpackage/bin/services/chat/channels/feishu/InboundAttachment.jsmatched "\\u4e00"3
lowObfuscationpackage/bin/services/contact/runtime/InboxStore.jsmatched "Buffer.from(file.content, \"base64"3
lowObfuscationpackage/bin/services/contact/runtime/LinkCode.jsmatched "Buffer.from(input, \"base64"3
lowObfuscationpackage/bin/shared/utils/logger/Logger.jsmatched "\\x1b"3
lowObfuscationpackage/bin/services/task/runtime/Paths.jsmatched "\\u0000"3
lowObfuscationpackage/bin/main/modules/cli/Plugins.jsmatched "\\u001b"3
lowObfuscationpackage/bin/services/chat/channels/feishu/PostMessage.jsmatched "\\u4e00"3
lowObfuscationpackage/bin/shared/utils/cli/PrettyStatus.jsmatched "\\u001b"3
lowObfuscationpackage/bin/services/shell/runtime/ShellActionRuntimeSupport.jsmatched "\\u0000"3
lowObfuscationpackage/bin/plugins/tts/runtime/Synthesizer.jsmatched "\\u3400"3
lowObfuscationpackage/bin/services/chat/channels/qq/VoiceInput.jsmatched "\\u4e00"3
lowObfuscationpackage/test/main/cli-output.test.mjsmatched "\\u001b"3

Manifest

Package metadata

Scripts10
  • buildnode -e "require('node:fs').rmSync('bin', { recursive: true, force: true })" && tsc && tsc-alias -f && node scripts/copy-prompt-assets.mjs && node scripts/ensure-cli-executable.mjs
  • devtsc --watch
  • lintnpm run lint:boundaries
  • lint:boundariesnode scripts/lint-import-boundaries.mjs
  • prepacknpm run build
  • startnode bin/start.js
  • testnpm run build && node --test test/**/*.test.mjs
  • test:modelnpm run build && node --test test/model/create-model.test.mjs
  • test:model:smokenode test/test-model.mjs
  • typechecktsc --noEmit
Dependencies29
  • @ai-sdk/anthropic^3.0.28
  • @ai-sdk/google^3.0.6
  • @ai-sdk/huggingface^1.0.37
  • @ai-sdk/moonshotai^2.0.10
  • @ai-sdk/open-responses^1.0.6
  • @ai-sdk/openai^3.0.21
  • @ai-sdk/openai-compatible^2.0.0
  • @ai-sdk/xai^3.0.67
  • @larksuiteoapi/node-sdk^1.40.0
  • @openrouter/ai-sdk-provider^2.2.3
  • ai^6.0.57
  • better-sqlite3^11.10.0
  • chalk^5.4.0
  • commander^12.0.0
  • diff^7.0.0
  • dotenv^16.4.0
  • drizzle-orm^0.36.4
  • execa^9.5.0
  • fast-glob^3.3.0
  • fs-extra^11.2.0
  • hono^4.0.0
  • js-yaml^4.1.0
  • nanoid^5.1.6
  • node-cron^3.0.0
  • openai^4.0.0
  • ora^8.2.0
  • prompts^2.4.0
  • ws^8.19.0
  • zod^3.24.0