PkgRadar

Package evidence

[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Versions published
15
First published
May 2026
Publisher
brandonpowers

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherbrandonpowers
Artifact bytes904,469
Previous version0.5.0
Published2026-06-03T22:50:42.570Z
SHA-2566346e9a4af807b91a80694d765fb02c7c0d13d22d690eba0c3ffa6a5a9f46ba8

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
62Score
0.5.1Version
Status history (1 event)
  1. new → available · risk review · score 62 · status changed

Evidence

Static findings

8 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/carbon/cloud-init/k3s/master-init.shmatched "curl "12
mediumRemote Payloadpackage/carbon/cloud-init/k3s/supabase-init.shmatched "curl "12
mediumRemote Payloadpackage/carbon/k8s/test-local.shmatched "curl "12
mediumRemote Payloadpackage/carbon/cloud-init/k3s/worker-init.shmatched "curl "12
Show all 8 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/carbon/cloud-init/k3s/master-init.shmatched "curl "12
mediumRemote Payloadpackage/carbon/cloud-init/k3s/supabase-init.shmatched "curl "12
mediumRemote Payloadpackage/carbon/k8s/test-local.shmatched "curl "12
mediumRemote Payloadpackage/carbon/cloud-init/k3s/worker-init.shmatched "curl "12
lowCredential file accesspackage/src/lib/deploy/k8s/k3s.jsmatched "aws_access_key"5
lowCredential file accesspackage/services/s3/compose/docker-compose.s3-ha.ymlmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/services/s3/compose/docker-compose.s3.ymlmatched "AWS_ACCESS_KEY"3
lowCredential file accesspackage/carbon/docker-compose.ymlmatched "AWS_ACCESS_KEY"3

Manifest

Package metadata

Scripts29
  • bump:majornode scripts/bump.js major
  • bump:minornode scripts/bump.js minor
  • bump:patchnode scripts/bump.js patch
  • devnode scripts/dev.js
  • formatbiome format --write src/ tests/
  • lintnode scripts/check-shell-safety.js && node scripts/check-stale-deploy-references.js && biome check src/ tests/
  • lint:fixbiome check --write src/ tests/
  • lint:shellnode scripts/check-shell-safety.js
  • lint:stale-deploynode scripts/check-stale-deploy-references.js
  • preparegit config core.hooksPath git-hooks
  • prepublishOnlypnpm test:unit && pnpm lint
  • testvitest run
  • test:civitest run --reporter=junit --outputFile=test-results.xml
  • test:clivitest run --project integration tests/integration/cli
  • test:coveragevitest run --coverage
  • test:dockerDOCKER_INTEGRATION=true vitest run --project integration tests/integration/docker
  • test:e2eREAL_INFRA=true tsx tests/e2e/runner.ts
  • test:e2e:batchREAL_INFRA=true tsx tests/e2e/runner.ts --batch
  • test:e2e:ciREAL_INFRA=true vitest run --project e2e
  • test:e2e:expandedREAL_INFRA=true tsx tests/e2e/runner.ts --batch --expanded
  • test:e2e:reporttsx tests/e2e/metrics/reporter.ts
  • test:e2e:singleREAL_INFRA=true vitest run --project e2e tests/e2e/single
  • test:integrationvitest run --project integration
  • test:loadtesttsx tests/loadtest/cli.ts
  • test:modulesvitest run --project integration tests/integration/modules
  • test:prepushpnpm lint && pnpm test:unit && pnpm test:integration
  • test:templatevitest run --project integration tests/integration/template
  • test:unitvitest run --project unit
  • test:watchvitest
Dependencies7
  • @aws-sdk/client-s3^3.1058.0
  • @clack/prompts^1.5.0
  • @pulumi/hcloud^1.38.0
  • @pulumi/pulumi^3.244.0
  • bcryptjs^3.0.3
  • undici^8.3.0
  • which^7.0.0