Package evidence

[email protected]

Remote Payload: matched "curl "

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'

Publishertw93

Artifact bytes12,759,810

Previous version3.11.5

Published2026-05-15T00:02:41.622Z

SHA-256417868e20fee1b782182f6666be0d937634e731f03f6e958bb873b3ceb05841c

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

23d agoLast checked

reviewRisk

18Score

3.11.6Version

Status history (1 event)

new → available23d ago · risk review · score 18 · status changed

Evidence

Static findings

3 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/cli.js	matched "curl "	12

Show all 3 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/cli.js	matched "curl "	12
low	Obfuscation	package/dist/cli.js	matched "\\u4e00"	3
low	Obfuscation	package/src-tauri/src/inject/event.js	matched "atob("	3

Manifest

Package metadata

Scripts14

analyzecd src-tauri && cargo bloat --release --crates
buildtauri build
build:debugtauri build --debug
build:mactauri build --target universal-apple-darwin
clicross-env NODE_ENV=development rollup -c -w
cli:buildcross-env NODE_ENV=production rollup -c
devpnpm run tauri dev
formatprettier --write . --ignore-unknown && find tests -name '*.js' -exec sed -i '' 's/[[:space:]]*$//' {} \; && cd src-tauri && cargo fmt --verbose
format:checkprettier --check . --ignore-unknown
prepublishOnlypnpm run cli:build
startpnpm run dev
tauritauri
testpnpm run cli:build && cross-env PAKE_CREATE_APP=1 node tests/index.js
updatepnpm update --verbose && cd src-tauri && cargo update

Dependencies15

@tauri-apps/api~2.10.1
@tauri-apps/cli^2.10.0
chalk^5.6.2
commander^14.0.3
execa^9.6.1
file-type^21.3.0
fs-extra^11.3.3
icon-gen^5.0.0
loglevel^1.9.2
ora^9.3.0
prompts^2.4.2
psl^1.15.0
sharp^0.34.5
tmp-promise^3.0.3
update-notifier^7.3.1