Static pattern: tarball-extras-suspicious:scripts/postinstall.sh — 1 caught

AUTO-PUBLISHED/npm/2026-06-01

by lightman217

Kids OpenCode — a kid-safe AI coding mentor (12+). One-command install via `bun add -g @kidsinai/kids-opencode`.

→ sends tohttps://json.schemastore.org/package.json

public-github-pushcurl-pipe-bashtarball-extras-suspicious:scripts/postinstall.sh

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

30.0 KB

versions