PkgRadar

Package evidence

[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
2
First published
May 2026
Publisher
ferlatorre78

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherferlatorre78
Artifact bytes9,489,591
Previous versionnone
Published2026-05-18T21:48:42.226Z
SHA-256909ba833e2eefff58ca97a23308659b4917838212b25372df7f2806aa13bce3e

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
53Score
1.3.11Version
Status history (1 event)
  1. new → available · risk review · score 53 · status changed

Evidence

Static findings

5 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/scripts/bootstrap-single-tenant.shmatched "curl "12
mediumRemote Payloadpackage/scripts/portal-web-go-no-go.shmatched "curl\n\n"12
mediumRemote Payloadpackage/fabric-multicloud/k8s/osnadmin-join-job.yamlmatched "curl "12
mediumRemote Payloadpackage/fabric-multicloud/k8s/osnadmin-list-job.yamlmatched "curl "12
Show all 5 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/scripts/bootstrap-single-tenant.shmatched "curl "12
mediumRemote Payloadpackage/scripts/portal-web-go-no-go.shmatched "curl\n\n"12
mediumRemote Payloadpackage/fabric-multicloud/k8s/osnadmin-join-job.yamlmatched "curl "12
mediumRemote Payloadpackage/fabric-multicloud/k8s/osnadmin-list-job.yamlmatched "curl "12
lowCredential file accesspackage/docker_build_local.shmatched "NPM_TOKEN"5

Manifest

Package metadata

Scripts40
  • api:closebash ./scripts/stop-local-api.sh
  • api:local-demonpm run build:swagger && npx dotenv -e .env.local-demo -e .env.local -- nodemon --legacy-watch --watch 'src/**/*.ts' --watch 'swagger.config.cjs' --exec 'TS_NODE_TRANSPILE_ONLY=1 TS_NODE_SKIP_IGNORE=1 TS_NODE_COMPILER_OPTIONS={\"module\":\"NodeNext\",\"moduleResolution\":\"NodeNext\",\"allowImportingTsExtensions\":true} node --loader ts-node/esm --experimental-specifier-resolution=node src/main.ts'
  • api:local-postgresnpm run build:swagger && npx dotenv -e .env.local.postgres -e .env.local -- nodemon --legacy-watch --watch 'src/**/*.ts' --watch 'swagger.config.cjs' --exec 'TS_NODE_TRANSPILE_ONLY=1 TS_NODE_SKIP_IGNORE=1 TS_NODE_COMPILER_OPTIONS={\"module\":\"NodeNext\",\"moduleResolution\":\"NodeNext\",\"allowImportingTsExtensions\":true} node --loader ts-node/esm --experimental-specifier-resolution=node src/main.ts'
  • buildnpm run clean && npm run build:swagger && tsc && node scripts/patch-esm-imports.mjs
  • build:openapi-profilesnode scripts/generate-openapi-profiles.mjs
  • build:swaggerTS_NODE_TRANSPILE_ONLY=1 TS_NODE_SKIP_IGNORE=1 TS_NODE_COMPILER_OPTIONS='{"module":"NodeNext","moduleResolution":"NodeNext","allowImportingTsExtensions":true}' node --loader ts-node/esm --experimental-specifier-resolution=node scripts/generate-swagger-spec.mts && node scripts/generate-openapi-profiles.mjs && node --loader ts-node/esm --experimental-specifier-resolution=node scripts/generate-core-flow-examples.mjs
  • check:portal-web-go-no-gobash ./scripts/portal-web-go-no-go.sh
  • cleanrm -rf build
  • db:local-postgres:downdocker compose -f docker-compose.postgres.yml down -v
  • db:local-postgres:logsdocker compose -f docker-compose.postgres.yml logs -f postgres
  • db:local-postgres:resetnpm run db:local-postgres:down && npm run db:local-postgres:up
  • db:local-postgres:updocker compose -f docker-compose.postgres.yml up -d
  • demo:bootstrap-single-tenantif [ -f .env.local-demo ]; then npx dotenv -e .env.local-demo -- ./scripts/bootstrap-single-tenant.sh; elif [ -f .env.local ]; then npx dotenv -e .env.local -- ./scripts/bootstrap-single-tenant.sh; elif [ -f .env.local.txt ]; then npx dotenv -e .env.local.txt -- ./scripts/bootstrap-single-tenant.sh; else echo 'ERROR: missing .env.local-demo/.env.local/.env.local.txt'; exit 1; fi
  • demo:bootstrap-single-tenant:loggedbash ./scripts/run-with-log.sh bootstrap-single-tenant npm run demo:bootstrap-single-tenant
  • devnpm run build:swagger && nodemon --legacy-watch --watch 'src/**/*.ts' --watch 'swagger.config.cjs' --exec 'TS_NODE_TRANSPILE_ONLY=1 TS_NODE_SKIP_IGNORE=1 TS_NODE_COMPILER_OPTIONS={\"module\":\"NodeNext\",\"moduleResolution\":\"NodeNext\",\"allowImportingTsExtensions\":true} DOTENV_CONFIG_PATH=.env.local node --import dotenv/config --loader ts-node/esm --experimental-specifier-resolution=node src/main.ts'
  • dev:loggedbash ./scripts/run-with-log.sh dev npm run dev
  • docker:build./docker_build.sh
  • docker:run./docker_run.sh
  • docs:flow-reportTS_NODE_TRANSPILE_ONLY=1 TS_NODE_SKIP_IGNORE=1 TS_NODE_COMPILER_OPTIONS='{"module":"NodeNext","moduleResolution":"NodeNext","allowImportingTsExtensions":true}' node --loader ts-node/esm --experimental-specifier-resolution=node scripts/run-api-integrators-guide-flow.mts
  • formatprettier --write 'src/**/*.{ts,js}'
  • linteslint 'src/**/*.{ts,js}' --fix
  • lint:checkeslint 'src/**/*.{ts,js}'
  • pki:generateTS_NODE_TRANSPILE_ONLY=1 TS_NODE_SKIP_IGNORE=1 TS_NODE_COMPILER_OPTIONS='{"module":"NodeNext","moduleResolution":"NodeNext","allowImportingTsExtensions":true}' node --loader ts-node/esm --experimental-specifier-resolution=node scripts/generate-pki-chain.ts
  • pki:hostTS_NODE_TRANSPILE_ONLY=1 TS_NODE_SKIP_IGNORE=1 TS_NODE_COMPILER_OPTIONS='{"module":"NodeNext","moduleResolution":"NodeNext","allowImportingTsExtensions":true}' node --loader ts-node/esm --experimental-specifier-resolution=node scripts/generate-host.ts
  • pki:icaTS_NODE_TRANSPILE_ONLY=1 TS_NODE_SKIP_IGNORE=1 TS_NODE_COMPILER_OPTIONS='{"module":"NodeNext","moduleResolution":"NodeNext","allowImportingTsExtensions":true}' node --loader ts-node/esm --experimental-specifier-resolution=node scripts/generate-ica.ts
  • pki:memberTS_NODE_TRANSPILE_ONLY=1 TS_NODE_SKIP_IGNORE=1 TS_NODE_COMPILER_OPTIONS='{"module":"NodeNext","moduleResolution":"NodeNext","allowImportingTsExtensions":true}' node --loader ts-node/esm --experimental-specifier-resolution=node scripts/generate-member.ts
  • pki:rootTS_NODE_TRANSPILE_ONLY=1 TS_NODE_SKIP_IGNORE=1 TS_NODE_COMPILER_OPTIONS='{"module":"NodeNext","moduleResolution":"NodeNext","allowImportingTsExtensions":true}' node --loader ts-node/esm --experimental-specifier-resolution=node scripts/generate-root-ca.ts
  • prettierprettier --write "src/**/*.ts"
  • prettier:checkprettier --check "src/**/*.ts"
  • run:with-logbash ./scripts/run-with-log.sh
  • …and 10 more.
Dependencies39
  • @ahryman40k/ts-fhir-types^4.0.39
  • @firebase/rules-unit-testing^5.0.0
  • @google-cloud/storage^7.17.3
  • @hyperledger/fabric-gateway^1.9.0
  • @hyperledger/fabric-protos^0.3.7
  • @noble/ciphers^2.0.0
  • @noble/post-quantum^0.5.1
  • @peculiar/webcrypto^1.5.0
  • @stablelib/base64^2.0.1
  • @stablelib/utf8^2.0.1
  • @types/argon2^0.14.1
  • @types/base-x^3.0.0
  • @types/cors^2.8.19
  • argon2^0.44.0
  • asn1js^3.0.6
  • base-x^5.0.1
  • canonicalize^2.1.0
  • cors^2.8.5
  • env-var^7.5.0
  • express^4.18.2
  • firebase-admin^13.5.0
  • gdc-common-utils-ts^1.4.20
  • google-auth-library^9.0.0
  • jose^4.15.9
  • js-base64^3.7.8
  • mongodb^5.6.0
  • multiformats^13.4.1
  • node-forge^1.3.3
  • pako^2.1.0
  • pdf-lib^1.17.1
  • …and 9 more.