Static pattern: py-sys-platform-branch — 1 caught | Cremit

AUTO-PUBLISHED/kitchen-sink · 11/npm/2026-06-07

ltcai12 versions·0.1.29→3.1.0

by taesoopark

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

steals →Seed phrasenpm tokenPyPI tokenGitHub PATAI API keysKeePassDiscord tokensChromium logins

reads-env-varschild-process-spawncurl-pipe-bashpy-sys-platform-branchreads-github-tokensreads-ai-api-keysreads-chromium-credsreads-keepass+18

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

15.8 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@ngocsangairvds/vsaf@4.2.9

by ngocsangairvds

logging step

steals →AI API keys

reads-env-varschild-process-spawnreads-ai-api-keyspy-urllib-requestpy-sys-platform-branchpy-pip-install-runtimecurl-pipe-bashwebhook-bin+2

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

10.3 MB

versions

115

AUTO-PUBLISHED/pypi/2026-06-04

azure-genome@0.1.4

A Python package for Azure Genome.

steals →Chromium logins→ sends tohttps://github.com/python/cpython/pull/119891

py-requests-postreads-env-varseval-dynamicchild-process-spawnreads-homedirreads-system-infowebhook-binpy-socket-connect+6

weekly

/wk

h-score

patterns

size

3.2 MB

versions

AUTO-PUBLISHED/pypi/2026-06-04

sealights-python-agent@2.10.10

by Tricentis Sealights

Tricentis Sealights Python Agent - Quality Intelligence and Code Coverage

steals →Chromium logins→ sends tohttps://packaging.python.org/en/latest/distributing.html

py-pip-install-runtimereads-env-varspy-urllib-requestfs-recursive-readreads-homedirreads-system-infowebhook-binpy-socket-connect+8

weekly

11K

/wk

h-score

patterns

size

1.9 MB

versions

175

AUTO-PUBLISHED/pypi/2026-06-04

epyt@2.3.5.1

by Marios S. Kyriakou

EPyT: An EPANET-Python Toolkit for Smart Water Network Simulations. The EPyT is inspired by the EPANET-Matlab Toolkit.

steals →PyPI token→ sends tohttps://github.com/OpenWaterAnalytics/EPANET

reads-pypircfs-recursive-readhttp-to-public-ipchild-process-spawnpy-sys-platform-branch

→ 크리덴셜 읽기 (reads-pypirc) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

3.9 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

youtube-downloader-web@1.0.0

by ragha02

A professional full-stack YouTube Downloader powered by yt-dlp.

steals →Apple/CloudKitChromium loginsFirefox logins

py-pip-install-runtimereads-chromium-credsreads-env-varspy-sys-platform-branchbase64-decodereads-firefox-credsreads-homedirfs-recursive-read+10

→ 크리덴셜 읽기 (reads-apple-cloudkit) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

12.0 MB

versions

AUTO-PUBLISHED/pypi/2026-05-26/MAL-2026-4814

vectordb-engine@1.0.0

by VectorDB Contributors

High-performance vector similarity search with SIMD-optimized kernels

reads-env-varsreads-system-infochild-process-spawnpy-sys-platform-branch

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

25.4 KB

versions

AUTO-PUBLISHED/pypi/2026-05-26/MAL-2026-4748

eplang@8.0.0

EPL - English Programming Language: write code in plain English. Build apps, web servers, and more.

steals →AWS keysGitHub PATChromium logins→ sends tohttp://localhost:11434

child-process-spawnfs-recursive-readpy-pip-install-runtimepy-urllib-requestclipboard-accessreads-github-tokensreads-env-varsreads-homedir+11

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s), 2 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

952.4 KB

versions

AUTO-PUBLISHED/pypi/2026-05-22

easy-tdx@1.0.0

by Justin Gu

通达信 TCP 协议行情数据客户端，支持在线行情与离线本地数据读取

archive-then-uploadhttp-to-public-ippy-socket-connecthex-decodereads-env-varspy-sys-platform-branchchild-process-spawnpy-pip-install-runtime

→ 하드코딩된 public IP 전송지: 180.153.18.170, 124.71.187.122, 180.153.18.171, 180.153.18.172, 119.147.212.81, 115.238.56.198, 115.238.90.165, 218.75.126.9, 47.107.75.159, 59.175.238.38, 110.41.147.114, 110.41.2.72, 101.33.225.16, 175.178.112.197, 175.178.128.227, 43.139.95.83, 124.223.163.242, 122.51.120.217, 150.158.160.2, 123.60.164.122, 111.229.247.189, 124.70.199.56, 62.234.50.143, 81.70.151.186, 82.156.214.79, 159.75.29.111, 43.139.18.171, 81.71.32.47, 122.51.232.182, 118.25.98.114, 121.36.225.169, 123.60.70.228, 123.60.73.44, 124.70.133.119, 124.71.187.72, 119.97.185.59, 129.204.230.128, 101.42.240.54, 124.71.9.153, 123.60.84.66, 111.230.186.52, 101.0.0.43 (RFC1918·loopback 아님).

weekly

—

/wk

llm verdict

malicious 0.90

h-score

patterns

size

9.9 MB

versions