// Data staging
패턴: session-start-hook
Packages whose static analysis matched this pattern. See the per-package detail pages for the offending code excerpt.
6개 패키지에 이 패턴이 매칭됨 (총 publish 이벤트 15건을 publisher+name 기준으로 묶음). 최신순.
P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品
→ 크리덴셜 읽기 (reads-ai-api-keys, reads-seed-phrase) + 외부 전송지 http-to-public-ip, dest-via-hostname-var 조합 — 전형적인 유출 패턴.
AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,
→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.
Types for Microsoft Graph objects
Microsoft Application Insights Common JavaScript Library
JavaScript cryptography library providing hashing, HMAC, PBKDF2, AES encryption, and encoding utilities
Local proxy server that manages multiple Claude Code sessions with Telegram integration, LinkedIn posting, voice transcription, and Unsplash image search through a single bot connection per machine
→ 의심 전송지로 발송: api.telegram.org.
