Package evidence
fabric-dw==2026.6.0a0
Remote Payload: matched "curl "
Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Versions published
- 1
- First published
- Jun 2026
Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["fabric-dw==2026.6.0a0"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["fabric-dw==2026.6.0a0"],"fail_on":"high"}'Why flagged
What the scanner saw
Remote Payload: matched "curl "
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 50 · status changed
Evidence
Static findings
18 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a0bd2d1c01a4606d8/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a153f2b81173e1c09/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a1be0829f1bdfc54c/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a26d2fc969ee7bf98/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a2998ce218e089bdd/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a2da0bc3c05cb6283/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a4972cecedbcb5fbd/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a5dfa8e0c94652436/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a688be44407349a1e/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a691039073acbea4d/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a78979bf3aa521e49/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a9c27d25282e2651a/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-a9d5b8e2c9ff38e32/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-aa1ac1003562cd7bc/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-ab6b5ce694fbed289/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-ad0544b61f030cd7e/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/.claude/worktrees/agent-aec39aa30abab715a/docs_build/cloudflare_pages.sh | matched "curl " | 12 |
| medium | Remote Payload | fabric_dw-2026.6.0a0/docs_build/cloudflare_pages.sh | matched "curl " | 12 |