Recommended action
Block this updateStatic evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"high"}'Why flagged
What the scanner saw
Remote Payload: matched "curl "
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk high · score 237 · status changed
Related candidates
Linked campaigns and clusters
pekeler
2 members · evidence strength 64Evidence
Static findings
28 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsAuthRefresh-UjveHHwo.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsAuthWithOAuth2-DUIE4EoY.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsAuthWithOTP-CJKph96j.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsAuthWithPassword-DEWj8Jyn.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsBatch-DNJl1NTn.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsCreate-Be3S3y5K.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsDelete-CybOn5jy.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsEmailChange-BgOZfOYE.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsList-BAfVNUIM.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsListAuthMethods-9feSopQX.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsPasswordReset-db1tMCuS.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsRealtime-PMESvmJN.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsUpdate-LtD8DbWI.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsVerification-B_Nb90xU.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsView-Be6Uhvcf.js | matched "curl " | 12 |
| medium | Obfuscation Density | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/plugins/wordcount/plugin.min.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/tinymce.min.js | high encoded/escaped-token density | 12 |
Show all 28 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsAuthRefresh-UjveHHwo.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsAuthWithOAuth2-DUIE4EoY.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsAuthWithOTP-CJKph96j.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsAuthWithPassword-DEWj8Jyn.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsBatch-DNJl1NTn.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsCreate-Be3S3y5K.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsDelete-CybOn5jy.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsEmailChange-BgOZfOYE.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsList-BAfVNUIM.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsListAuthMethods-9feSopQX.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsPasswordReset-db1tMCuS.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsRealtime-PMESvmJN.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsUpdate-LtD8DbWI.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsVerification-B_Nb90xU.js | matched "curl " | 12 |
| medium | Remote Payload | package/vendor/pocketbase-admin-ui/dist/assets/docsView-Be6Uhvcf.js | matched "curl " | 12 |
| medium | Obfuscation Density | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/plugins/wordcount/plugin.min.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/tinymce.min.js | high encoded/escaped-token density | 12 |
| low | Obfuscation | package/dist/examples/base/main.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/models/dom/model.min.js | matched "\\xa0" | 3 |
| low | Obfuscation | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/plugins/autolink/plugin.min.js | matched "\\ufeff" | 3 |
| low | Obfuscation | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/plugins/codesample/plugin.min.js | matched "\\u00a0" | 3 |
| low | Obfuscation | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/plugins/link/plugin.min.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/plugins/lists/plugin.min.js | matched "\\x3c" | 3 |
| low | Obfuscation | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/plugins/wordcount/plugin.min.js | matched "\\u2018" | 3 |
| low | Obfuscation | package/vendor/pocketbase-admin-ui/dist/assets/pocketbase.es-B_4DUNUU.js | matched "\\u0009" | 3 |
| low | Obfuscation | package/vendor/pocketbase-admin-ui/dist/libs/prism/prism.js | matched "\\u00a0" | 3 |
| low | Obfuscation | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/themes/silver/theme.min.js | matched "\\ufeff" | 3 |
| low | Obfuscation | package/vendor/pocketbase-admin-ui/dist/libs/tinymce/tinymce.min.js | matched "\\ufeff" | 3 |
Manifest
Package metadata
Scripts37
agent-scriptbun run scripts/agent_script.tsbench:upstreambun run scripts/bench_run_upstream.tsbench:upstream:factor-summarybun scripts/bench_upstream_factor_summary.jsbench:upstream:pocketbunbun run scripts/bench_run_upstream_pocketbun.tsbuildbun build index.ts src/cli.ts --outdir dist --target bun --format esm --packages external && bun run build:typesbuild:analyzebun build index.ts src/cli.ts --outdir=.tmp/build-analysis --target=bun --format=esm --packages external --metafile=.tmp/build-analysis/meta.json --metafile-md=.tmp/build-analysis/meta.mdbuild:typesbun x tsc -p tsconfig.types.json && bun run scripts/build_declarations.tscheck:versionsbun run scripts/check_versions.ts && bun run scripts/docs/sync_docs_version.ts --checkdocs:checkbun run scripts/docs/sync_docs_version.ts --check && bun run scripts/docs/check_generated_docs.tsdocs:patchbun run scripts/docs/apply_pocketbun_patches.tsdocs:rebuildbun run scripts/docs/rebuild_from_upstream.ts && bun run docs:patch && bun run docs:versiondocs:rebuild:fullbun run docs:sync-upstream && bun run docs:rebuild && bun run docs:checkdocs:sync-upstreambash scripts/docs/sync_upstream_site_docs.shdocs:versionbun run scripts/docs/sync_docs_version.tse2ebun run scripts/e2e_run.tse2e:installplaywright install --with-depsformatoxfmt --check src tests scriptsformat:fixoxfmt --write src tests scriptslintoxlint --type-aware src tests scriptsprepackbun run buildprofile:cpubash scripts/profile_cpu_md.shprofile:heapbash scripts/profile_heap_md.shprofile:heap:scenariobash scripts/profile_heap_scenario.shprofile:inspector:listbun run scripts/profile_inspector_records_list.tsreleasebash scripts/release.sh publish pocketbunrelease:checkbun run format:fix && bun run check:versions && bun test --concurrent && bun run typecheck && bun run typecheck:package && bun run lintrelease:createbash scripts/release.sh publish create-pocketbunrelease:create:drybash scripts/release.sh dry create-pocketbunrelease:drybash scripts/release.sh dry pocketbunstartbun run index.ts- …and 7 more.