Package evidence

[email protected]

Remote Payload: matched "curl "

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publisherturtle.tech

Artifact bytes365,635

Previous version3.1.15

Published2026-05-24T20:34:36.616Z

SHA-256c99cf2fc13d7b569d359c57429ea8856c4c961b3f2ede068d49c289c283d98c3

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

24d agoLast checked

highRisk

69Score

3.1.19Version

Status history (1 event)

new → available24d ago · risk high · score 69 · status changed

Related candidates

Linked campaigns and clusters

Publisher / release actor burststale

turtle.tech

7 members · evidence strength 84

Evidence

Static findings

14 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/index-wt8rz4gn.js	matched "curl "	12
medium	Obfuscation Density	package/dist/cli/index.js	high encoded/escaped-token density	12
medium	Remote Payload	package/bin/trellis.mjs	matched "curl "	12

Show all 14 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
medium	Remote Payload	package/dist/index-wt8rz4gn.js	matched "curl "	12
medium	Obfuscation Density	package/dist/cli/index.js	high encoded/escaped-token density	12
medium	Remote Payload	package/bin/trellis.mjs	matched "curl "	12
low	Obfuscation	package/dist/index-3qrxzwe4.js	matched "\\u2026"	3
low	Obfuscation	package/dist/index-53f3b8p8.js	matched "fromCharCode"	3
low	Obfuscation	package/dist/index-65z0xfjw.js	matched "\\u2026"	3
low	Obfuscation	package/dist/index-a2a394zz.js	matched "\\u2014"	3
low	Obfuscation	package/dist/index-h7zxhhhh.js	matched "\\u2014"	3
low	Obfuscation	package/dist/index-hr9qvv77.js	matched "\\u2192"	3
low	Obfuscation	package/dist/index-wt8rz4gn.js	matched "fromCharCode"	3
low	Obfuscation	package/dist/index-yp88he8n.js	matched "\\x00"	3
low	Obfuscation	package/dist/cli/index.js	matched "\\x1b"	3
low	Obfuscation	package/dist/cms/index.js	matched "\\u2014"	3
low	Obfuscation	package/dist/core/index.js	matched "\\u2192"	3

Manifest

Package metadata

Scripts9

buildbun build src/index.ts src/core/index.ts src/vcs/index.ts src/embeddings/index.ts src/links/index.ts src/decisions/index.ts src/server/index.ts src/client/index.ts src/react/index.ts src/db/index.ts src/cli/index.ts src/cms/index.ts src/core/persist/sqljs-backend.ts src/core/persist/factory.ts src/server/node-adapter.ts --outdir dist --target bun --splitting --format esm --root src --external @xenova/transformers --external @huggingface/transformers --external react --external sql.js --external ws && mkdir -p dist/ui && cp src/ui/client.html dist/ui/client.html && tsc -p tsconfig.build.json --emitDeclarationOnly --noEmit false --noEmitOnError false && bun run build:inspector
build:inspectorvite build --config vite.inspector.config.ts
clibun run src/cli/index.ts
devbun run src/index.ts
mcpbun run src/mcp/index.ts
mcp:docsbun run src/mcp/docs.ts
prepublishOnlynpm run test && npm run build
testbun test test/core test/cms test/vcs test/git test/p2 test/p3 test/p4 test/p5 test/p6 test/p7 test/engine.test.ts test/cli
test:allbun test

Dependencies7

@inquirer/prompts^8.2.2
@modelcontextprotocol/sdk^1.6.0
chalk^5.4.1
commander^13.1.0
opencode-ai^1.3.5
turtlecode^0.3.23
zod3

Optional dependencies4

@huggingface/transformers^3.0.0
@xenova/transformers^2.17.2
sql.js^1.14.1
ws^8.20.1