// npm package

weavedb-warp-contracts-plugin-deploy

A deploy plugin for warp contracts

npmjs.com tarball

versions

maintainers

license

MIT

first publish

2023-10-13

publisher

asteroiddao

tarball

3,215,172 B

AUTO-PUBLISHED·2 versions indexed·latest published 2026-05-26

// publisher campaignby asteroiddao

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @1.0.11· 1 file flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@1.0.11·2026-05-26·AUTO-PUBLISHED·publisher: asteroiddao
heuristic 89/100
static flags 2
llm benign (0.85) via ollama
install-scripts:preinstallnew-publisher:1dpublisher-multi-name-burst:16publisher-version-pump:17osv-flagged:MAL-2026-4727base64-decodechild-process-spawn
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
// NHI intent1 target·mixed harvest patterns·gate: always
- SSH private keysssh-private-keys
```
var lxe=Object.create;var T4=Object.defineProperty;var Axe=Object.getOwnPropertyDescriptor;var hxe=Object.getOwnPropertyNames;var dxe=Object.getPrototypeOf,pxe=Object.prototype.hasOwnProperty;var gxe=(t,e,r)=>e in t?T4(t,e,{enumerable:!0,co
```