// Data staging

Static pattern: invokes-secret-scanner

패턴: invokes-secret-scanner

Packages whose static analysis matched this pattern. See the per-package detail pages for the offending code excerpt.

3개 패키지에 이 패턴이 매칭됨 (총 publish 이벤트 8건을 publisher+name 기준으로 묶음). 최신순.

• AUTO-PUBLISHED/kitchen-sink · 21/npm/2026-06-06

  @blamejs/exceptd-skills3 versions·0.16.23→0.16.25

  by dotcoocoo

  AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

  steals →Crypto walletSeed phrasenpm tokenPyPI tokenCargo creds
• AUTO-PUBLISHED/npm/2026-06-06

  rtexit-method4 versions·0.1.18→0.1.28

  by ahmed_samir_53

  RTExit - AI-assisted Red Team methodology installer

  → sends tohttps://github.com/exit-code-eg/RTExit.git

  public-github-pushinvokes-secret-scannerchild-process-spawncurl-pipe-basharchive-then-uploadbase64-decodereverse-shellreads-env-vars

  정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

• AUTO-PUBLISHED/npm/2026-05-19

  @stelnyx/secgate@0.2.13

  by doceno

  Tiny security gate for CI/CD — orchestrates Semgrep, Gitleaks, osv-scanner, Trivy, and npm audit with a premium HTML report.

  → sends tohttps://github.com/Stelnyx/SecGate.git

  invokes-secret-scannerpublic-github-pushreads-env-varspy-pip-install-runtimechild-process-spawn

  → 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

  weekly

  —

  /wk