AUTO-PUBLISHEDMulti-name burst/kitchen-sink · 21/npm/
@blamejs/exceptd-skills3 versions·0.16.23→0.16.25
by dotcoocoo
AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,
steals →Crypto walletSeed phrasenpm tokenPyPI tokenCargo credsAWS keysGCP credsAzure credsGitHub PATKubeconfigDocker authSSH keysAI API keysMCP configmacOS Keychain1PasswordSlack tokensChromium logins→ sends tohttps://exceptd.com
clipboard-accessreads-env-varspublic-github-pushchild-process-spawnreads-github-tokensreads-homedirreads-ai-api-keysreads-system-info+26
→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.
weekly
—
/wk
llm verdict
malicious 0.96
h-score
52
patterns
34
size
35.0 MB
versions
292