Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Remote Payload: matched "cUrl "
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 45 · status changed
Evidence
Static findings
12 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/build/widgets/oa-widget-image-carousel/ImageCarouselWidget.js | matched "cUrl " | 12 |
Show all 12 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/build/widgets/oa-widget-image-carousel/ImageCarouselWidget.js | matched "cUrl " | 12 |
| low | Obfuscation | package/build/widgets/oa-widget-add-spare-part/AddSparePartCollapseWidget.js | matched "\\u20B9" | 3 |
| low | Obfuscation | package/build/widgets/oa-widget-add-spare-part/AddSparePartWidget.js | matched "\\u20B9" | 3 |
| low | Obfuscation | package/build/widgets/oa-widget-approval/ApprovalWidgetNew.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/build/widgets/oa-widget-collapsible-key-value/CollapsibleKeyValueWidget.js | matched "\\u20B9" | 3 |
| low | Obfuscation | package/build/widgets/oa-widget-input-pattern-pin/CustomPinPatternCaptureWidget.js | matched "\\xA0" | 3 |
| low | Obfuscation | package/build/widgets/oa-form-widget/FormWidget.js | matched "\\u20B9" | 3 |
| low | Obfuscation | package/build/widgets/oa-widget-item-info-card/InfoCardListWidget.js | matched "\\u20B9" | 3 |
| low | Obfuscation | package/build/widgets/oa-widget-item-info-card/ItemInfoCardWidget.js | matched "\\u20B9" | 3 |
| low | Obfuscation | package/build/widgets/oa-widget-pincode-base-location/PincodeBaseLocation.js | matched "\\u201C" | 3 |
| low | Obfuscation | package/build/widgets/oa-widget-spare-part/SparePartsCollapseWidget.js | matched "\\u20B9" | 3 |
| low | Obfuscation | package/build/components/oa-component-accordion/styles.js | matched "\\uD83D" | 3 |
Manifest
Package metadata
Scripts11
buildrm -rf build && NODE_ENV=production babel src/lib --out-dir build --copy-filesbuild-storybookstorybook buildlinteslint src/** --ext .js,.jsxlint-fixnpm run lint -- --fixlint-fix-quietnpm run lint-fix -- --quietpre-commit./pre-commit.shpublish:localnpm run build && yalc push --forcestartreact-scripts startstorybookstorybook dev -p 6006update-package-locknpm i --package-lock-onlywatch:publishonchange 'src/lib/**/*' -- npm run publish:local
Dependencies17
@ant-design/icons^5.2.6@babel/plugin-proposal-private-property-in-object^7.21.11@material-ui/system^4.12.2@storybook/addon-actions^7.6.3@storybook/addon-styling^1.3.7@storybook/cli^7.6.3antd^5.11.4d3^7.8.5dayjs^1.11.10immer^10.1.1pdfjs-dist^2.6.347react-google-maps^9.4.5react-intersection-observer^8.32.5react-markdown^8.0.7react-pattern-lock^12.0.12react-pdf^5.3.0react-zoom-pan-pinch^3.7.0