PkgRadar

Package evidence

[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
1,032Niche · −30% score
Versions published
12
First published
May 2026
Publisher
brandonpowers

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherbrandonpowers
Artifact bytes886,650
Previous version0.2.1
Published2026-05-29T22:18:27.811Z
SHA-256363b7ab71b5f3629794abde8a154e8801bc3dbc753faebff1d31431a976f073c

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
50Score
0.3.0Version
Status history (1 event)
  1. new → available · risk review · score 50 · status changed

Evidence

Static findings

10 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/carbon/cloud-init/k3s/master-init.shmatched "curl "12
mediumRemote Payloadpackage/carbon/cloud-init/k3s/supabase-init.shmatched "curl "12
mediumRemote Payloadpackage/carbon/k8s/test-local.shmatched "curl "12
mediumRemote Payloadpackage/carbon/cloud-init/k3s/worker-init.shmatched "curl "12
Show all 10 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/carbon/cloud-init/k3s/master-init.shmatched "curl "12
mediumRemote Payloadpackage/carbon/cloud-init/k3s/supabase-init.shmatched "curl "12
mediumRemote Payloadpackage/carbon/k8s/test-local.shmatched "curl "12
mediumRemote Payloadpackage/carbon/cloud-init/k3s/worker-init.shmatched "curl "12
lowCredential file accesspackage/src/lib/deploy/compose/index.jsmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/carbon/backup/backup.shmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/carbon/backup/compose-backup.shmatched "AWS_ACCESS_KEY"5
lowCredential file accesspackage/services/s3/compose/docker-compose.s3-ha.ymlmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/services/s3/compose/docker-compose.s3.ymlmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/carbon/docker-compose.ymlmatched "AWS_ACCESS_KEY"3

Manifest

Package metadata

Scripts29
  • bump:majornode scripts/bump.js major
  • bump:minornode scripts/bump.js minor
  • bump:patchnode scripts/bump.js patch
  • devnode scripts/dev.js
  • formatbiome format --write src/ tests/
  • lintnode scripts/check-shell-safety.js && node scripts/check-stale-deploy-references.js && biome check src/ tests/
  • lint:fixbiome check --write src/ tests/
  • lint:shellnode scripts/check-shell-safety.js
  • lint:stale-deploynode scripts/check-stale-deploy-references.js
  • preparegit config core.hooksPath git-hooks
  • prepublishOnlypnpm test:unit && pnpm lint
  • testvitest run
  • test:civitest run --reporter=junit --outputFile=test-results.xml
  • test:clivitest run --project integration tests/integration/cli
  • test:coveragevitest run --coverage
  • test:dockerDOCKER_INTEGRATION=true vitest run --project integration tests/integration/docker
  • test:e2eREAL_INFRA=true tsx tests/e2e/runner.ts
  • test:e2e:batchREAL_INFRA=true tsx tests/e2e/runner.ts --batch
  • test:e2e:ciREAL_INFRA=true vitest run --project e2e
  • test:e2e:expandedREAL_INFRA=true tsx tests/e2e/runner.ts --batch --expanded
  • test:e2e:reporttsx tests/e2e/metrics/reporter.ts
  • test:e2e:singleREAL_INFRA=true vitest run --project e2e tests/e2e/single
  • test:integrationvitest run --project integration
  • test:loadtesttsx tests/loadtest/cli.ts
  • test:modulesvitest run --project integration tests/integration/modules
  • test:prepushpnpm lint && pnpm test:unit && pnpm test:integration
  • test:templatevitest run --project integration tests/integration/template
  • test:unitvitest run --project unit
  • test:watchvitest
Dependencies7
  • @aws-sdk/client-s3^3.1017.0
  • @clack/prompts^1.1.0
  • @pulumi/hcloud^1.32.2
  • @pulumi/pulumi^3.231.0
  • bcryptjs^3.0.3
  • undici^8.1.0
  • which^7.0.0