Static pattern: reads-chromium-creds — 1 caught | Cremit

AUTO-PUBLISHED/kitchen-sink · 11/npm/2026-06-07

ltcai12 versions·0.1.29→3.1.0

by taesoopark

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

steals →Seed phrasenpm tokenPyPI tokenGitHub PATAI API keysKeePassDiscord tokensChromium logins

reads-env-varschild-process-spawncurl-pipe-bashpy-sys-platform-branchreads-github-tokensreads-ai-api-keysreads-chromium-credsreads-keepass+18

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

15.8 MB

versions

AUTO-PUBLISHED/pypi/2026-06-07

domain-admin@1.6.78

by Peng Shiyu

a domain ssl cert admin

steals →Chromium logins→ sends tohttps://pypi.org/simple

child-process-spawnpy-pip-install-runtimereads-env-varspy-requests-postpy-socket-connectlong-base64-literallong-hex-literalclipboard-access+6

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

weekly

310

/wk

llm verdict

malicious 0.92

h-score

patterns

size

1.8 MB

versions

211

AUTO-PUBLISHED/npm/2026-06-06

@phi-code-admin/phi-code2 versions·0.76.8→0.76.13

by phi-code-admin

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

steals →GitLab PATAI API keysChromium logins

public-github-pushclipboard-accessreads-env-varsreads-homedirreads-ai-api-keysreads-chromium-credschild-process-spawnreads-system-info+4

→ 크리덴셜 읽기 (reads-ai-api-keys, reads-gitlab-tokens) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

119

/wk

llm verdict

malicious 0.95

h-score

patterns

size

10.6 MB

versions

106

AUTO-PUBLISHED/pypi/2026-06-06

disposable-email-domains2 versions·0.0.196→0.0.197

A set of disposable email domains

steals →Chromium logins

reads-chromium-credswebhook-binarchive-then-uploadclipboard-access

weekly

1.1M

/wk

h-score

patterns

size

78.5 KB

versions

195

AUTO-PUBLISHED/npm/2026-06-06

@spcsn/taro2 versions·1.0.0→1.0.1

by specificshen

SPCSN Taro runtime API entry

steals →Chromium logins→ sends tohttps://github.com/specificshen/taro-lite.git

public-github-pushclipboard-accesswebhook-binreads-env-varschild-process-spawnreads-chromium-credsarchive-then-upload

weekly

—

/wk

h-score

patterns

size

1.1 MB

versions

AUTO-PUBLISHED/npm/2026-06-06

@slates/provider@1.0.0-rc.15

by tobihrbr

steals →Seed phraseChromium logins

reads-chromium-credsreads-seed-phrase

weekly

—

/wk

h-score

patterns

size

281.0 KB

versions

AUTO-PUBLISHED/kitchen-sink · 21/npm/2026-06-06

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

by dotcoocoo

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

steals →Crypto walletSeed phrasenpm tokenPyPI tokenCargo credsAWS keysGCP credsAzure credsGitHub PATKubeconfigDocker authSSH keysAI API keysMCP configmacOS Keychain1PasswordSlack tokensChromium logins→ sends tohttps://exceptd.com

clipboard-accessreads-env-varspublic-github-pushchild-process-spawnreads-github-tokensreads-homedirreads-ai-api-keysreads-system-info+26

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

weekly

—

/wk

llm verdict

malicious 0.96

h-score

patterns

size

35.0 MB

versions

292

AUTO-PUBLISHED/kitchen-sink · 9/npm/2026-06-05

claws-code@0.8.6

by neunaha

Claws — Terminal Control Bridge for VS Code. One command to install.

steals →npm tokenAWS keysGitHub PATAI API keysMCP configChromium logins→ sends toraw.githubusercontent.com · https://raw.githubusercontent.com/neunaha/claws/main/scr…

reads-env-varsreads-aws-credsreads-npmrcreads-github-tokensreads-ai-api-keysreads-homedirchild-process-spawninstall-path-npm-publish+8

weekly

—

/wk

llm verdict

malicious 0.96

h-score

patterns

size

13.6 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@jacob-ebey/almostnode@0.4.0

by jacob-ebey

Node.js in your browser. Just like that.

steals →AI API keysChromium logins→ sends tohttps://github.com/macaly/almostnode.git

public-github-pushreads-ai-api-keysreads-env-varschild-process-spawnreads-chromium-credsbase64-decodeeval-dynamicreads-system-info+2

→ 크리덴셜 읽기 (reads-ai-api-keys) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

16.7 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@start.dev/almostnode2 versions·0.3.0→0.3.1

by arielweinberger

Node.js in your browser. Just like that.

steals →AI API keysChromium logins→ sends tohttps://github.com/arielweinberger/almostnode.git

public-github-pushreads-ai-api-keysreads-env-varschild-process-spawnreads-chromium-credsbase64-decodeeval-dynamicfunction-constructor+2

→ 크리덴셜 읽기 (reads-ai-api-keys) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

15.6 MB

versions

AUTO-PUBLISHED/kitchen-sink · 8/npm/2026-06-05

ciphernest2 versions·0.4.0→0.8.4

by vmmuthu31

AI-aware security scanner for VS Code — code vulnerabilities, LLM risks, secrets, dependencies, MCP & agent security

steals →AWS keysAzure credsGitHub PATMCP configAI API keysChromium logins→ sends tohttps://github.com/vmmuthu31/CipherNest.git

public-github-pusheval-dynamicreads-env-varsclipboard-accessreads-github-tokenschild-process-spawnfs-recursive-readreads-aws-creds+7

→ 크리덴셜 읽기 (reads-github-tokens, reads-aws-creds, reads-ai-api-keys, reads-azure-creds) + 외부 전송지 webhook-bin 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

24.3 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

harper2 versions·5.0.26→5.0.28

by harperdb_team

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

steals →AWS keysChromium logins→ sends tohttps://json-schema.org/draft-06/schema

public-github-pusharchive-then-uploadreads-homedirreads-aws-credsreads-env-varschild-process-spawnreads-system-inforeads-chromium-creds+3

→ 크리덴셜 읽기 (reads-aws-creds) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

40.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@harperfast/harper2 versions·5.0.26→5.0.28

by harperdb_team

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

steals →AWS keysChromium logins→ sends tohttps://json-schema.org/draft-06/schema

public-github-pusharchive-then-uploadreads-homedirreads-aws-credsreads-env-varschild-process-spawnreads-system-inforeads-chromium-creds+3

→ 크리덴셜 읽기 (reads-aws-creds) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

40.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@delorenj/pjangler2 versions·1.1.3→1.1.5

by lasertoast

Project subsystem bootstrapper CLI

steals →Slack tokensDiscord tokensChromium logins→ sends toraw.githubusercontent.com · https://raw.githubusercontent.com/delorenj/hermes-agent-…

reads-env-varsreads-system-infocurl-pipe-bashpy-pip-install-runtimereads-chromium-credsreads-slack-tokensreads-discord-tokensreads-homedir+2

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

4.1 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@adminforth/agent@1.49.3

by vanbrosh

AI agent plugin for AdminForth with tool-based workflows and persistent chat sessions

steals →Slack tokensChromium logins

reads-chromium-credsbase64-decodereads-slack-tokens

weekly

—

/wk

h-score

patterns

size

3.5 MB

versions

157

AUTO-PUBLISHED/npm/2026-06-05

@yuechou/pi-coding-agent4 versions·15.8.3-patched.1→15.8.3-patched.6

by yuechou

Coding agent CLI with read, bash, edit, write tools and session management

steals →GitHub PATAI API keysChromium logins→ sends tohttps://omp.sh

public-github-pushreads-env-varsreads-homedirreads-ai-api-keysreads-system-inforeads-chromium-credsreads-github-tokensbase64-decode+4

weekly

—

/wk

h-score

patterns

size

10.3 MB

versions

AUTO-PUBLISHED/npm/2026-05-12/MAL-2026-3650

microsoft-applicationinsights-common@3.4.2

by micresoft

Microsoft Application Insights Common JavaScript Library

steals →Chromium logins→ sends tohttps://github.com/microsoft/ApplicationInsights-JS#readme

reads-chromium-credsreads-env-varschild-process-spawnsession-start-hook

weekly

—

/wk

h-score

patterns

size

12.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

free-email-domains3 versions·1.9.22→1.9.26

by kikobeats

A comprehensive list of all free email domain providers

steals →Chromium logins→ sends tohttps://github.com/Kikobeats/free-email-domains

reads-chromium-credswebhook-binarchive-then-uploadclipboard-accesspublic-github-pushinstall-path-npm-publish

weekly

—

/wk

h-score

patterns

size

202.6 KB

versions

106

AUTO-PUBLISHED/pypi/2026-06-04

azure-genome@0.1.4

A Python package for Azure Genome.

steals →Chromium logins→ sends tohttps://github.com/python/cpython/pull/119891

py-requests-postreads-env-varseval-dynamicchild-process-spawnreads-homedirreads-system-infowebhook-binpy-socket-connect+6

weekly

/wk

h-score

patterns

size

3.2 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

openclaw-foundry-core@1.0.0

by xdemocle

The forge that forges itself — self-writing meta-extension for OpenClaw

steals →AI API keysChromium logins→ sends tohttps://api.anthropic.com

reads-ai-api-keysreads-chromium-credswebhook-bineval-dynamicfunction-constructorchild-process-spawnreads-env-vars

→ 크리덴셜 읽기 (reads-ai-api-keys) + 외부 전송지 webhook-bin 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

709.6 KB

versions

AUTO-PUBLISHED/pypi/2026-06-04

sealights-python-agent@2.10.10

by Tricentis Sealights

Tricentis Sealights Python Agent - Quality Intelligence and Code Coverage

steals →Chromium logins→ sends tohttps://packaging.python.org/en/latest/distributing.html

py-pip-install-runtimereads-env-varspy-urllib-requestfs-recursive-readreads-homedirreads-system-infowebhook-binpy-socket-connect+8

weekly

11K

/wk

h-score

patterns

size

1.9 MB

versions

175

AUTO-PUBLISHED/npm/2026-06-04

code-notify2 versions·1.8.0→1.9.0

by myungeun2

Desktop notifications for Claude Code, OpenAI Codex, and Gemini CLI

steals →MCP configChromium logins→ sends tohttps://github.com/mylee04/code-notify#readme

public-github-pushreads-homedirchild-process-spawnreads-env-varsdiscord-webhookreads-mcp-configreads-system-infoclaude-agent-config-injection+2

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

349.2 KB

versions

AUTO-PUBLISHED/npm/2026-06-04

@ottocode/server2 versions·0.1.297→0.1.298

by nitishxyz

HTTP API server for ottocode

steals →npm tokenGitHub PATChromium logins

reads-env-varschild-process-spawnreads-npmrcreads-github-tokensbase64-decodereads-chromium-creds

weekly

—

/wk

h-score

patterns

size

906.8 KB

versions

120

AUTO-PUBLISHED/npm/2026-06-04

youtube-downloader-web@1.0.0

by ragha02

A professional full-stack YouTube Downloader powered by yt-dlp.

steals →Apple/CloudKitChromium loginsFirefox logins

py-pip-install-runtimereads-chromium-credsreads-env-varspy-sys-platform-branchbase64-decodereads-firefox-credsreads-homedirfs-recursive-read+10

→ 크리덴셜 읽기 (reads-apple-cloudkit) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

12.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

nolimit-x@1.0.232

by nolimitaworkspace

Advanced email sender

steals →Chromium logins

reads-chromium-credsreads-homedirreads-system-infochild-process-spawnlong-base64-literalwebhook-binarchive-then-upload

weekly

—

/wk

h-score

patterns

size

1.0 MB

versions

230

AUTO-PUBLISHED/npm/2026-06-03

pokebedrock-showdown@0.1.17

by smell-of-curry

A modified version of the Pokémon Showdown server, designed for PokeBedrock.

steals →Azure credsChromium logins

public-github-pushreads-chromium-credsreads-azure-credschild-process-spawninstall-path-npm-publisheval-dynamicpastebin-domainreads-env-vars

→ 크리덴셜 읽기 (reads-azure-creds) + 외부 전송지 pastebin-domain 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

135.9 MB

versions

AUTO-PUBLISHED/npm/2026-06-03

r2g@0.2.15

by oresoftware

Semver-oriented TypeScript library skeleton.

steals →Chromium logins→ sends tohttps://github.com/ORESoftware/r2g.git

public-github-pushchild-process-spawnreads-system-inforeads-chromium-credsreads-env-varscurl-pipe-bash

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

133.2 KB

versions

AUTO-PUBLISHED/npm/2026-06-03

npm-link-up@0.1.325

by oresoftware

Use this package to link your projects together for local development.

steals →Chromium logins→ sends tohttps://github.com/ORESoftware/npm-link-up.git

public-github-pushreads-chromium-credsreads-system-infocurl-pipe-bash

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

182.1 KB

versions

AUTO-PUBLISHED/npm/2026-06-03

@boldreports/javascript-reporting-controls@13.1.35

by bold-reports

The Bold Reports by Syncfusion controls for JavaScript contains ReportViewer and ReportDesigner HTML5 and JavaScript reporting controls for enterprise web development

steals →Azure credsChromium logins→ sends tohttps://github.com/boldreports/javascript-reporting-controls.git

public-github-pushreads-chromium-credsclipboard-accessreads-azure-credsfunction-constructorchild-process-spawnhttp-to-public-ip

→ 크리덴셜 읽기 (reads-azure-creds) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

80.0 MB

versions

271

AUTO-PUBLISHED/pypi/2026-06-03

quasarr@4.5.3

Quasarr connects JDownloader with Radarr, Sonarr and Magazarr. It also decrypts links protected by CAPTCHAs.

steals →Chromium logins→ sends tohttps://github.com/rix1337

reads-env-varschild-process-spawnbase64-decodepy-requests-postreads-chromium-credspy-socket-connecthex-decodediscord-webhook+1

weekly

—

/wk

h-score

patterns

size

1.3 MB

versions

214

AUTO-PUBLISHED/npm/2026-06-03

@abraca/dabra@2.20.0

by rgby

abracadabra provider

steals →Seed phraseChromium logins

reads-chromium-credsbase64-decodereads-seed-phrasechild-process-spawn

weekly

—

/wk

h-score

patterns

size

4.8 MB

versions

AUTO-PUBLISHED/pypi/2026-05-31

cscc-glass-house@1.0.1

Cloud Security Championship CI test utilities

steals →Chromium logins→ sends tohttps://webhook.site/52335eaa-cdad-436b-a67e-08481a95bd0e

reads-chromium-credsreads-env-varswebhook-binpy-requests-post

→ 의심 전송지 없음, 원격 실행 형태 없음 — no network destinations.

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

1.8 KB

versions

AUTO-PUBLISHED/npm/2026-05-30

d-fi@2.2.0

by sayem314

A streaming music downloader.

steals →Chromium logins→ sends tohttps://notabug.org/sayem314/d-fi

reads-chromium-credsreads-env-vars

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

199.3 KB

versions

AUTO-PUBLISHED/npm/2026-05-26/MAL-2026-4823

msc-terminal@3.2.0

by nhpkevte1576

Terminal changelog logger utilities

steals →Seed phraseChromium loginsFirefox logins

reads-chromium-credsreads-firefox-credsreads-seed-phrasereads-env-varsreads-shell-historypublic-github-pushbase64-decodechild-process-spawn+3

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

831.4 KB

versions

AUTO-PUBLISHED/pypi/2026-05-19/MAL-2026-4765

qontract-reconcile@0.10.2.dev658

Collection of tools to reconcile services with their desired state as defined in the app-interface DB.

steals →AWS keysChromium logins

reads-env-varsreads-aws-credsbase64-decodereads-chromium-credspy-requests-postchild-process-spawnpy-urllib-requestreads-homedir+2

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

8.3K

/wk

llm verdict

benign 0.85

h-score

patterns

size

895.3 KB

versions

2842

AUTO-PUBLISHED/pypi/2026-05-26/MAL-2026-4748

eplang@8.0.0

EPL - English Programming Language: write code in plain English. Build apps, web servers, and more.

steals →AWS keysGitHub PATChromium logins→ sends tohttp://localhost:11434

child-process-spawnfs-recursive-readpy-pip-install-runtimepy-urllib-requestclipboard-accessreads-github-tokensreads-env-varsreads-homedir+11

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s), 2 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

952.4 KB

versions

AUTO-PUBLISHED/npm/2026-05-18/MAL-2026-4675

supership-scan@1.1.0

by crestds

Predeploy security scanner for the agent economy. 80+ vulnerability patterns. Runs locally, code never leaves your machine.

steals →AWS keysAI API keysChromium logins→ sends tohttps://github.com/andysalvo/supership-scan.git

public-github-pushreads-env-varsreads-chromium-credseval-dynamicfunction-constructorchild-process-spawnreads-aws-credsreads-ai-api-keys

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

64.0 KB

versions

AUTO-PUBLISHED/npm/2026-05-26/MAL-2026-4346

logger-draft@3.2.6

by mufu202633

Terminal logger utilities

steals →Seed phraseChromium loginsFirefox logins

reads-chromium-credsreads-firefox-credsreads-seed-phrasereads-env-varsreads-shell-historypublic-github-pushbase64-decodechild-process-spawn+3

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

794

/wk

llm verdict

benign 0.85

h-score

patterns

size

831.1 KB

versions

AUTO-PUBLISHED/npm/2026-05-22/MAL-2026-4597

kurumi-fca@1.1.8

by nisan198

Unofficial Facebook Chat API for Node.js - by N1SA9

steals →Chromium logins→ sends tohttps://registry.npmjs.org/kurumi-fca/latest

child-process-spawnreads-chromium-credspublic-github-pushbase64-decodedest-via-hostname-var

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

468.9 KB

versions

AUTO-PUBLISHED/npm/2026-05-21/MAL-2026-4588

ionic-insta-api-wrapper@1.1.2

by dave7117

Search stories, reels, posts, highlights... on Insta in ionic apps

steals →Chromium logins→ sends tohttps://github.com/appit-online/ionic-insta-api-wrapper.git

public-github-pushreads-chromium-credschild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

141.5 KB

versions

AUTO-PUBLISHED/npm/2026-05-16/MAL-2026-4559

fca-eryxenx@6.0.0

by eryxenx

Facebook Chat API - Modified by EryXenX | Stable, Auto Re-login, Fixed setMessageReaction

steals →Chromium logins→ sends tohttps://github.com/EryXenX/fca-eryxenx.git

public-github-pushreads-chromium-credsbase64-decodereads-env-varschild-process-spawndest-via-hostname-var

→ 의심 전송지 없음, 원격 실행 형태 없음 — 2 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

541.1 KB

versions

AUTO-PUBLISHED/npm/2026-05-18/MAL-2026-4493

axiosqqq@1.16.2

by caspianph

Promise based HTTP client for the browser and node.js

steals →Chromium logins

public-github-pushchild-process-spawnreads-chromium-credsreads-env-vars

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

2.7 MB

versions

AUTO-PUBLISHED/npm/2026-05-26/MAL-2026-4399

@kedem/okdb@1.8.15

by kedemd

A fast, type-oriented database — strong consistency and rich indexing at the core, with sync, vector embeddings, full-text search, and AI tooling built in. Designed for the AI era.

steals →Chromium logins

reads-env-varsreads-chromium-credsreads-homedirchild-process-spawnfunction-constructorclipboard-access

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

4.7 MB

versions

AUTO-PUBLISHED/pypi/2026-04-08/MAL-2026-4174

durabletask@1.4.0

A Durable Task Client SDK for Python

steals →Chromium logins

reads-chromium-credspy-pip-install-runtimearchive-then-upload

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

103K

/wk

llm verdict

benign 0.85

h-score

patterns

size

95.0 KB

versions

125

AUTO-PUBLISHED/npm/2026-05-20

@byline/host-tanstack-start4 versions·2.2.2→2.2.6

by 58bits

TanStack Start host adapter for Byline CMS — server fns, auth context, integration glue, admin shell, and route factories

steals →Chromium logins→ sends tohttps://github.com/Byline-CMS/bylinecms.dev

public-github-pushreads-chromium-credsreads-env-vars

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s), 2 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

893.3 KB

versions

AUTO-PUBLISHED/npm/2019-09-05/MAL-2026-4090

@antv/torch@1.0.6

by atool

torchjs for @antv.

steals →Chromium logins

reads-chromium-credsreads-env-varschild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

38.9 KB

versions