Static pattern: dest-via-hostname-var — 1 caught | Cremit

AUTO-PUBLISHED/pypi/2026-06-07

domain-admin@1.6.78

by Peng Shiyu

a domain ssl cert admin

steals →Chromium logins→ sends tohttps://pypi.org/simple

child-process-spawnpy-pip-install-runtimereads-env-varspy-requests-postpy-socket-connectlong-base64-literallong-hex-literalclipboard-access+6

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

weekly

310

/wk

llm verdict

malicious 0.92

h-score

patterns

size

1.8 MB

versions

211

AUTO-PUBLISHED/npm/2026-06-07

zudoku-security-helper@99.0.0

by gagesgr

Security helper for Zudoku

steals →npm tokenAWS keysGitHub PAT

reads-aws-credsreads-npmrcreads-github-tokensreads-homedirreads-system-infodest-via-hostname-var

→ 크리덴셜 읽기 (reads-aws-creds, reads-npmrc, reads-github-tokens) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.8 KB

versions

AUTO-PUBLISHED/npm/2026-06-06

@phi-code-admin/phi-code2 versions·0.76.8→0.76.13

by phi-code-admin

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

steals →GitLab PATAI API keysChromium logins

public-github-pushclipboard-accessreads-env-varsreads-homedirreads-ai-api-keysreads-chromium-credschild-process-spawnreads-system-info+4

→ 크리덴셜 읽기 (reads-ai-api-keys, reads-gitlab-tokens) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

119

/wk

llm verdict

malicious 0.95

h-score

patterns

size

10.6 MB

versions

106

AUTO-PUBLISHED/npm/2026-06-06

@f5xc-salesdemos/docs-theme2 versions·3.0.0→3.0.1

by robinmordasiewicz

F5 Distributed Cloud branded Starlight documentation theme

steals →AI API keys

reads-env-varsreads-ai-api-keyschild-process-spawndest-via-hostname-var

→ 크리덴셜 읽기 (reads-ai-api-keys) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

788

/wk

llm verdict

malicious 0.95

h-score

patterns

size

367.5 KB

versions

AUTO-PUBLISHED/npm/2026-06-06

berta-pulse@0.1.0

by rondanini

Local-first, BYOK multi-host ops + SEO control plane — scan, diagnose and fix across 12 hosts from your own machine.

steals →GCP credsAWS keysGitHub PATGitLab PATAI API keys→ sends tohttps://${branchName}.${app.defaultDomain}

reads-github-tokensreads-gitlab-tokensreads-gcp-credsreads-aws-credsreads-env-varschild-process-spawnreads-ai-api-keysdest-via-hostname-var

→ 크리덴셜 읽기 (reads-github-tokens, reads-gitlab-tokens, reads-gcp-creds, reads-aws-creds, reads-ai-api-keys) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.6 MB

versions

AUTO-PUBLISHED/npm/2026-06-06

@bolloon/bolloon-agent8 versions·0.1.16→0.1.28

by leoyoge

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

steals →Seed phraseAI API keys

reads-ai-api-keyschild-process-spawnreads-env-varsreads-seed-phraseclipboard-accessbase64-decodehex-decodereads-homedir+3

→ 크리덴셜 읽기 (reads-ai-api-keys, reads-seed-phrase) + 외부 전송지 http-to-public-ip, dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

8.5 MB

versions

AUTO-PUBLISHED/kitchen-sink · 9/npm/2026-06-05

claws-code@0.8.6

by neunaha

Claws — Terminal Control Bridge for VS Code. One command to install.

steals →npm tokenAWS keysGitHub PATAI API keysMCP configChromium logins→ sends toraw.githubusercontent.com · https://raw.githubusercontent.com/neunaha/claws/main/scr…

reads-env-varsreads-aws-credsreads-npmrcreads-github-tokensreads-ai-api-keysreads-homedirchild-process-spawninstall-path-npm-publish+8

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

weekly

—

/wk

llm verdict

malicious 0.96

h-score

patterns

size

13.6 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

totem-llm2 versions·0.3.1→0.3.2

by fred_terzi

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

steals →npm tokenAI API keysTelegram→ sends tohttps://github.com/fred-terzi/totem-llm.git

public-github-pushreads-env-varsreads-homedirreads-telegram-datachild-process-spawnreads-npmrcreads-ai-api-keysreads-system-info+3

→ 크리덴셜 읽기 (reads-npmrc, reads-ai-api-keys) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

27.4 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

@agentprojectcontext/apx5 versions·1.27.1→1.30.2

by tecnomanu

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

steals →AI API keysMCP config→ sends tohttp://localhost:7431

public-github-pushclipboard-accessreads-env-varsreads-ai-api-keysbase64-decodechild-process-spawnreads-homedirreads-mcp-config+4

→ 크리덴셜 읽기 (reads-ai-api-keys) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

10.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

@iola_adm/iola-cli21 versions·0.2.37→0.2.67

by iola_adm

CLI и AI-агент городского округа Йошкар-Ола.

steals →AI API keys→ sends tohttps://github.com/adm-iola/iola-cli#readme

public-github-pushreads-ai-api-keysreads-env-varsreads-homedirchild-process-spawneval-dynamicdest-via-hostname-var

→ 크리덴셜 읽기 (reads-ai-api-keys) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

2.8 MB

versions

179

AUTO-PUBLISHED/npm/2026-06-04

@trackunit/iris-app2 versions·2.0.5→2.0.6

by tu-publisher

The `@trackunit/iris-app` package is a plugin for [NX by @nrwl](https://nx.dev/). This plugin adds some helpful generators used to set up a Trackunit Iris App project.

steals →npm tokenMCP config

reads-npmrcreads-env-varsreads-mcp-configinstall-path-npm-publishdest-via-hostname-var

weekly

—

/wk

llm verdict

malicious 0.96

h-score

patterns

size

435.5 KB

versions

1076

AUTO-PUBLISHED/npm/2026-06-04

@qaecy/cue-ui2 versions·0.0.23→0.0.25

by madsholten

QAECY UI Web Components

→ sends tohttps://docs.mapbox.com/mapbox-gl-js/guides/install/#transpiling

reads-env-varsbase64-decodechild-process-spawnpastebin-domainfunction-constructorlong-base64-literalclipboard-accesslong-hex-literal+2

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

weekly

—

/wk

llm verdict

malicious 0.92

h-score

patterns

size

14.7 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

@almadar/llm@2.21.0

by javasop

Multi-provider LLM client with rate limiting, token tracking, structured outputs, and continuation handling

steals →AI API keys→ sends tohttps://github.com/almadar-io/almadar-llm.git

public-github-pushreads-ai-api-keysreads-env-varsdest-via-hostname-var

→ 크리덴셜 읽기 (reads-ai-api-keys) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

427.1 KB

versions

AUTO-PUBLISHED/npm/2026-06-03

vulnsweep3 versions·1.3.0→1.3.4

by carlosgalveias

VulnSweep CLI - npm vulnerability scanner

steals →GitHub PAT→ sends tohttps://eu.aptabase.com/api/v0/event

reads-github-tokensreads-env-varsreads-homedirreads-system-infobase64-decodechild-process-spawndest-via-hostname-var

→ 크리덴셜 읽기 (reads-github-tokens) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

272.9 KB

versions

AUTO-PUBLISHED/npm/2026-05-30

retail-location-strategy-frontend2 versions·1.1.1→1.1.2

by yusif-kerimov

Hijack by Yusif Kerimov

→ sends toulehcosybxwttseibbych07wphlyoxhfr.oast.fun

reads-homedirreads-system-infooast-callback-domaindest-via-hostname-var

→ 의심 전송지로 발송: ulehcosybxwttseibbych07wphlyoxhfr.oast.fun.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.3 KB

versions

AUTO-PUBLISHED/npm/2026-05-22/MAL-2026-4597

kurumi-fca@1.1.8

by nisan198

Unofficial Facebook Chat API for Node.js - by N1SA9

steals →Chromium logins→ sends tohttps://registry.npmjs.org/kurumi-fca/latest

child-process-spawnreads-chromium-credspublic-github-pushbase64-decodedest-via-hostname-var

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

468.9 KB

versions

AUTO-PUBLISHED/npm/2026-05-16/MAL-2026-4559

fca-eryxenx@6.0.0

by eryxenx

Facebook Chat API - Modified by EryXenX | Stable, Auto Re-login, Fixed setMessageReaction

steals →Chromium logins→ sends tohttps://github.com/EryXenX/fca-eryxenx.git

public-github-pushreads-chromium-credsbase64-decodereads-env-varschild-process-spawndest-via-hostname-var

→ 의심 전송지 없음, 원격 실행 형태 없음 — 2 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

541.1 KB

versions

AUTO-PUBLISHED/npm/2026-05-22

audit-logsss@8.0.9

by fwgewgewgewrhgw

audit-logs

→ sends toyihpvsviuggxabauqtuedjfyzjlrtkpzx.oast.fun

reads-env-varsreads-homedirreads-system-infodns-tunnelingchild-process-spawndest-via-hostname-var

→ 의심 전송지로 발송: yihpvsviuggxabauqtuedjfyzjlrtkpzx.oast.fun.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.0 KB

versions

AUTO-PUBLISHED/npm/2026-05-21

cryptoco-auth@1.0.3

by cryptogrfi

reads-system-infowebhook-binchild-process-spawndest-via-hostname-var

→ 의심 전송지로 발송: webhook.site.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

691 B

versions

AUTO-PUBLISHED/npm/2026-05-20

claude-internal-utils@9.0.5

by dewifewi

Alex Birsan Style

→ sends tolszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun

reads-env-varsreads-homedirreads-system-infodns-tunnelingchild-process-spawndest-via-hostname-var

→ 의심 전송지로 발송: lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.0 KB

versions

AUTO-PUBLISHED/npm/2026-05-20

anthropic-shared-logger@8.0.5

by dewifewi

Full RCE PoC - Alex Birsan Style

→ sends tolszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun

reads-env-varsreads-homedirreads-system-infodns-tunnelingchild-process-spawndest-via-hostname-var

→ 의심 전송지로 발송: lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

100

patterns

size

1.0 KB

versions

AUTO-PUBLISHED/npm/2026-05-20

private-next-pages@9.0.5

by dewifewi

Style

→ sends tolszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun

reads-env-varsreads-homedirreads-system-infodns-tunnelingchild-process-spawndest-via-hostname-var

→ 의심 전송지로 발송: lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1008 B

versions

AUTO-PUBLISHED/npm/2026-05-20

collected-forms-embed-js4 versions·1.0.1→8.0.5

by fwgewgewgewrhgw

Full RCE PoC - Alex Birsan Style

→ sends tolszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun

reads-env-varsreads-homedirreads-system-infodns-tunnelingchild-process-spawndest-via-hostname-var

→ 의심 전송지로 발송: lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.0 KB

versions

AUTO-PUBLISHED/npm/2026-05-20

did-00917 versions·11.0.5→11.2.8

by dewifewi

xxx

→ sends tolszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun

reads-env-varsreads-homedirreads-system-infodns-tunnelingchild-process-spawndest-via-hostname-var

→ 의심 전송지로 발송: lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

977 B

versions

AUTO-PUBLISHED/npm/2026-05-20

stripe-internal-utils2 versions·1.0.0→8.2.0

by dewifewi

Full RCE PoC -osama

→ sends tolszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun

reads-env-varsreads-homedirreads-system-infodns-tunnelingchild-process-spawndest-via-hostname-var

→ 의심 전송지로 발송: lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.0 KB

versions