// Data staging

Static pattern: bun-runtime-bootstrap

패턴: bun-runtime-bootstrap

Packages whose static analysis matched this pattern. See the per-package detail pages for the offending code excerpt.

4개 패키지에 이 패턴이 매칭됨 (총 publish 이벤트 5건을 publisher+name 기준으로 묶음). 최신순.

• AUTO-PUBLISHED/npm/2026-06-05

  cue-ai2 versions·0.9.0→0.9.2

  by imdeadpool

  cue — Agent Profile Manager for Claude Code & Codex. Pick a profile, launch with the right skills, MCPs, and plugins.

  steals →MCP config→ sends tohttps://github.com/opencue/cuecards

  public-github-pushcurl-pipe-bashbun-runtime-bootstrapreads-env-varschild-process-spawnreads-mcp-config
• AUTO-PUBLISHED/npm/2026-06-04

  @metamask/skills@0.1.0

  by metamaskbot

  Shared MetaMask agent skills installer and sync CLI.

  → sends tohttps://registry.npmjs.org/

  public-github-pushcurl-pipe-bashbun-runtime-bootstrap

  → 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

  weekly

  —

  /wk

  llm verdict

  malicious 0.95
• AUTO-PUBLISHED/npm/2026-05-29

  @agentuity/cli@2.0.23

  by huijiro

  steals →GitHub PATAI API keys

  reads-env-varschild-process-spawnbase64-decodereads-ai-api-keysclipboard-accessreads-homedirarchive-then-uploadbun-runtime-bootstrap+2

  → 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

• AUTO-PUBLISHED/npm/2026-05-26/MAL-2026-4398

  @jonusnattapong/claudecode@2.1.178

  by jonusnattapong

  Official Claude Code CLI — AI-powered coding assistant

  → sends tohttps://github.com/JonusNattapong/claudecode.git

  public-github-pushchild-process-spawnbun-runtime-bootstrap

  → 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s), 1 other host(s).

  weekly

  —

  /wk

  llm verdict

  benign