Static pattern: archive-then-upload — 1 caught | Cremit

AUTO-PUBLISHED/kitchen-sink · 11/npm/2026-06-07

ltcai12 versions·0.1.29→3.1.0

by taesoopark

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

steals →Seed phrasenpm tokenPyPI tokenGitHub PATAI API keysKeePassDiscord tokensChromium logins

reads-env-varschild-process-spawncurl-pipe-bashpy-sys-platform-branchreads-github-tokensreads-ai-api-keysreads-chromium-credsreads-keepass+18

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

15.8 MB

versions

AUTO-PUBLISHED/pypi/2026-06-07

domain-admin@1.6.78

by Peng Shiyu

a domain ssl cert admin

steals →Chromium logins→ sends tohttps://pypi.org/simple

child-process-spawnpy-pip-install-runtimereads-env-varspy-requests-postpy-socket-connectlong-base64-literallong-hex-literalclipboard-access+6

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

weekly

310

/wk

llm verdict

malicious 0.92

h-score

patterns

size

1.8 MB

versions

211

AUTO-PUBLISHED/pypi/2026-06-06

disposable-email-domains2 versions·0.0.196→0.0.197

A set of disposable email domains

steals →Chromium logins

reads-chromium-credswebhook-binarchive-then-uploadclipboard-access

weekly

1.1M

/wk

h-score

patterns

size

78.5 KB

versions

195

AUTO-PUBLISHED/npm/2026-06-06

@spcsn/taro2 versions·1.0.0→1.0.1

by specificshen

SPCSN Taro runtime API entry

steals →Chromium logins→ sends tohttps://github.com/specificshen/taro-lite.git

public-github-pushclipboard-accesswebhook-binreads-env-varschild-process-spawnreads-chromium-credsarchive-then-upload

weekly

—

/wk

h-score

patterns

size

1.1 MB

versions

AUTO-PUBLISHED/npm/2026-06-06

ethsmith@1.0.0

by webpalms

Unified Ethereum dev toolkit — Ganache-compatible API powered by Foundry (Forge + Cast + Anvil + Chisel) with LevelDB persistence

steals →Seed phrase→ sends tohttps://github.com/Lord1Egypt/ethsmith.git

public-github-pushreads-homedirreads-system-infochild-process-spawnarchive-then-uploadhex-decodereads-seed-phrasereads-env-vars

weekly

—

/wk

h-score

patterns

size

127.1 KB

versions

AUTO-PUBLISHED/npm/2026-06-06

rtexit-method3 versions·0.1.26→0.1.28

by ahmed_samir_53

RTExit - AI-assisted Red Team methodology installer

→ sends tohttps://github.com/exit-code-eg/RTExit.git

public-github-pushinvokes-secret-scannerchild-process-spawncurl-pipe-basharchive-then-uploadbase64-decodereverse-shellreads-env-vars

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

1.9K

/wk

llm verdict

malicious 0.95

h-score

patterns

size

3.3 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

harper2 versions·5.0.26→5.0.28

by harperdb_team

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

steals →AWS keysChromium logins→ sends tohttps://json-schema.org/draft-06/schema

public-github-pusharchive-then-uploadreads-homedirreads-aws-credsreads-env-varschild-process-spawnreads-system-inforeads-chromium-creds+3

→ Credential read (reads-aws-creds) paired with http-to-public-ip destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

40.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@harperfast/harper2 versions·5.0.26→5.0.28

by harperdb_team

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

steals →AWS keysChromium logins→ sends tohttps://json-schema.org/draft-06/schema

public-github-pusharchive-then-uploadreads-homedirreads-aws-credsreads-env-varschild-process-spawnreads-system-inforeads-chromium-creds+3

→ Credential read (reads-aws-creds) paired with http-to-public-ip destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

40.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

jishushell@0.6.5

by manager-aijishu

JishuShell — Raspberry Pi server management panel (Core + Web UI)

py-pip-install-runtimereads-system-inforeads-env-varschild-process-spawncurl-pipe-basharchive-then-upload

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

/wk

llm verdict

malicious 0.95

h-score

patterns

size

20.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@yuechou/pi-coding-agent4 versions·15.8.3-patched.1→15.8.3-patched.6

by yuechou

Coding agent CLI with read, bash, edit, write tools and session management

steals →GitHub PATAI API keysChromium logins→ sends tohttps://omp.sh

public-github-pushreads-env-varsreads-homedirreads-ai-api-keysreads-system-inforeads-chromium-credsreads-github-tokensbase64-decode+4

weekly

—

/wk

h-score

patterns

size

10.3 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

totem-llm2 versions·0.3.1→0.3.2

by fred_terzi

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

steals →npm tokenAI API keysTelegram→ sends tohttps://github.com/fred-terzi/totem-llm.git

public-github-pushreads-env-varsreads-homedirreads-telegram-datachild-process-spawnreads-npmrcreads-ai-api-keysreads-system-info+3

→ Credential read (reads-npmrc, reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

27.4 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

ai-engineering-harness2 versions·0.11.0→1.0.1

by davidtruong170621

Engineering discipline and workflow guardrails for AI coding agents (Claude, Cursor, Codex, Gemini).

steals →MCP config→ sends toraw.githubusercontent.com · https://raw.githubusercontent.com/truongnat/ai-engineeri…

reads-mcp-configcurl-pipe-bashclaude-agent-config-injectionarchive-then-uploadchild-process-spawn

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.3 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@adia-ai/a2ui-corpus4 versions·0.7.9→0.7.12

by kimgish-adia

AdiaUI A2UI training corpus — canonical v0.9 catalog + chunks + eval fixtures + feedback + gap registry. Consumed by the compose engine's retrieval layer + the MCP pipeline.

steals →1Password→ sends tohttps://registry.npmjs.org

public-github-pushreads-1passworddiscord-webhookclipboard-accessarchive-then-upload

weekly

3.3K

/wk

h-score

patterns

size

11.3 MB

versions

115

AUTO-PUBLISHED/npm/2026-06-05

free-email-domains3 versions·1.9.22→1.9.26

by kikobeats

A comprehensive list of all free email domain providers

steals →Chromium logins→ sends tohttps://github.com/Kikobeats/free-email-domains

reads-chromium-credswebhook-binarchive-then-uploadclipboard-accesspublic-github-pushinstall-path-npm-publish

weekly

—

/wk

h-score

patterns

size

202.6 KB

versions

106

AUTO-PUBLISHED/pypi/2026-06-04

azure-genome@0.1.4

A Python package for Azure Genome.

steals →Chromium logins→ sends tohttps://github.com/python/cpython/pull/119891

py-requests-postreads-env-varseval-dynamicchild-process-spawnreads-homedirreads-system-infowebhook-binpy-socket-connect+6

weekly

/wk

h-score

patterns

size

3.2 MB

versions

AUTO-PUBLISHED/pypi/2026-06-04

sealights-python-agent@2.10.10

by Tricentis Sealights

Tricentis Sealights Python Agent - Quality Intelligence and Code Coverage

steals →Chromium logins→ sends tohttps://packaging.python.org/en/latest/distributing.html

py-pip-install-runtimereads-env-varspy-urllib-requestfs-recursive-readreads-homedirreads-system-infowebhook-binpy-socket-connect+8

weekly

11K

/wk

h-score

patterns

size

1.9 MB

versions

175

AUTO-PUBLISHED/npm/2026-06-04

nodmix4 versions·2026.5.30→2026.5.35

by nodmix

Nodmix, the Supreme CEO Founder AI Agent. A large language model created and developed by Mehdi Faraj.

steals →AI API keys→ sends tohttps://nodmix.com

reads-env-varsreads-homedirchild-process-spawnpastebin-domainpublic-github-pusharchive-then-uploadreads-ai-api-keys

→ Credential read (reads-ai-api-keys) paired with pastebin-domain destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

100

patterns

size

42.1 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

youtube-downloader-web@1.0.0

by ragha02

A professional full-stack YouTube Downloader powered by yt-dlp.

steals →Apple/CloudKitChromium loginsFirefox logins

py-pip-install-runtimereads-chromium-credsreads-env-varspy-sys-platform-branchbase64-decodereads-firefox-credsreads-homedirfs-recursive-read+10

→ Credential read (reads-apple-cloudkit) paired with http-to-public-ip destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

12.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

@mettlecast/domain-cli5 versions·0.2.24→0.2.32

by lawrencegee

Local developer toolchain for TIB Domain Module projects. Provides build, validate, test, and dev subcommands.

steals →npm tokenGitHub PAT→ sends tohttps://mc-scaffold.s3.amazonaws.com/schema/manifest.v3.json

reads-github-tokensreads-npmrcreads-env-varschild-process-spawnpublic-github-pusharchive-then-uploadfs-recursive-read

weekly

—

/wk

h-score

patterns

size

1.2 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

nolimit-x@1.0.232

by nolimitaworkspace

Advanced email sender

steals →Chromium logins

reads-chromium-credsreads-homedirreads-system-infochild-process-spawnlong-base64-literalwebhook-binarchive-then-upload

weekly

—

/wk

h-score

patterns

size

1.0 MB

versions

230

AUTO-PUBLISHED/npm/2026-05-29

@agentuity/cli@2.0.23

by huijiro

steals →GitHub PATAI API keys

reads-env-varschild-process-spawnbase64-decodereads-ai-api-keysclipboard-accessreads-homedirarchive-then-uploadbun-runtime-bootstrap+2

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

weekly

2.2K

/wk

llm verdict

benign 0.85

h-score

patterns

size

7.7 MB

versions

254

AUTO-PUBLISHED/npm/2026-05-27

@chatlayer/app-platform@1.0.3

by yeryeb_sinch

This package contains the CLI tool `cldk` used to create app integrations.

steals →npm tokenGCP creds→ sends tohttps://app-integrations.chatlayer.ai

public-github-pushreads-env-varsreads-npmrcreads-gcp-credsbase64-decodereads-homedirchild-process-spawnarchive-then-upload

→ No suspicious destination, no remote-exec shape — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

122.8 KB

versions

AUTO-PUBLISHED/pypi/2026-05-19/MAL-2026-4765

qontract-reconcile@0.10.2.dev658

Collection of tools to reconcile services with their desired state as defined in the app-interface DB.

steals →AWS keysChromium logins

reads-env-varsreads-aws-credsbase64-decodereads-chromium-credspy-requests-postchild-process-spawnpy-urllib-requestreads-homedir+2

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

weekly

8.3K

/wk

llm verdict

benign 0.85

h-score

patterns

size

895.3 KB

versions

2842

AUTO-PUBLISHED/pypi/2026-05-26/MAL-2026-4813

noteparse@1.1.27

by maoyuyan

a package for parse html to noteinfo

→ sends tohttps://github.com/m294567571/noteparse.git

public-github-pushreads-homedirarchive-then-uploadpy-requests-post

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

30.0 KB

versions

AUTO-PUBLISHED/pypi/2026-05-26/MAL-2026-4748

eplang@8.0.0

EPL - English Programming Language: write code in plain English. Build apps, web servers, and more.

steals →AWS keysGitHub PATChromium logins→ sends tohttp://localhost:11434

child-process-spawnfs-recursive-readpy-pip-install-runtimepy-urllib-requestclipboard-accessreads-github-tokensreads-env-varsreads-homedir+11

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 2 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

952.4 KB

versions

AUTO-PUBLISHED/npm/2026-05-17/MAL-2026-4702

vestibulect@0.0.2

by bashneko

list of contributors in vestibule ORG

→ sends togithub.com · https://github.com/h3yng/vbct/releases/download/v0.0.1/v…

child-process-spawnarchive-then-upload

→ No suspicious destination, no remote-exec shape — 2 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

9.4 KB

versions

AUTO-PUBLISHED/npm/2026-05-15/MAL-2026-4694

tubebrain@0.1.10

by xoxdjess

Multi-platform stream ingestion and transcript extraction MCP server

steals →GitHub PAT→ sends tohttps://transscendsurvival.org/tubebrain/

public-github-pushreads-github-tokensreads-env-varsreads-homedirreads-system-infochild-process-spawnarchive-then-upload

→ No suspicious destination, no remote-exec shape — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

12.6 KB

versions

AUTO-PUBLISHED/npm/2026-05-26/MAL-2026-4455

@thebros/create-benjamin@1.0.23

by thebros

Benjamin CLI Generator

public-github-pusharchive-then-upload

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

weekly

2.7K

/wk

llm verdict

benign 0.85

h-score

patterns

size

2.3 KB

versions

AUTO-PUBLISHED/npm/2026-05-24

@serve.zone/catalog2 versions·2.12.5→2.12.6

by lossless

UI component catalog for serve.zone

http-to-public-ipclipboard-accesschild-process-spawnarchive-then-upload

→ Hardcoded public IP destination: 203.0.113.50, 203.0.113.10, 203.0.113.11 (not RFC1918 / loopback).

weekly

—

/wk

llm verdict

malicious 0.90

h-score

patterns

size

31.4 MB

versions

AUTO-PUBLISHED/pypi/2026-05-22

easy-tdx@1.0.0

by Justin Gu

通达信 TCP 协议行情数据客户端，支持在线行情与离线本地数据读取

archive-then-uploadhttp-to-public-ippy-socket-connecthex-decodereads-env-varspy-sys-platform-branchchild-process-spawnpy-pip-install-runtime

→ Hardcoded public IP destination: 180.153.18.170, 124.71.187.122, 180.153.18.171, 180.153.18.172, 119.147.212.81, 115.238.56.198, 115.238.90.165, 218.75.126.9, 47.107.75.159, 59.175.238.38, 110.41.147.114, 110.41.2.72, 101.33.225.16, 175.178.112.197, 175.178.128.227, 43.139.95.83, 124.223.163.242, 122.51.120.217, 150.158.160.2, 123.60.164.122, 111.229.247.189, 124.70.199.56, 62.234.50.143, 81.70.151.186, 82.156.214.79, 159.75.29.111, 43.139.18.171, 81.71.32.47, 122.51.232.182, 118.25.98.114, 121.36.225.169, 123.60.70.228, 123.60.73.44, 124.70.133.119, 124.71.187.72, 119.97.185.59, 129.204.230.128, 101.42.240.54, 124.71.9.153, 123.60.84.66, 111.230.186.52, 101.0.0.43 (not RFC1918 / loopback).

weekly

—

/wk

llm verdict

malicious 0.90

h-score

patterns

size

9.9 MB

versions

AUTO-PUBLISHED/pypi/2026-04-08/MAL-2026-4174

durabletask@1.4.0

A Durable Task Client SDK for Python

steals →Chromium logins

reads-chromium-credspy-pip-install-runtimearchive-then-upload

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

weekly

103K

/wk

llm verdict

benign 0.85

h-score

patterns

size

95.0 KB

versions

125

AUTO-PUBLISHED/npm/2026-03-29/MAL-2026-3847

openclaw-cn@0.2.0

by jiulingyun

Openclaw 中文版 - WhatsApp gateway CLI (Baileys web) with Pi RPC agent

steals →AI API keys→ sends tohttps://api.openai.com/v1/audio/transcriptions

archive-then-uploadreads-ai-api-keysreads-env-varsbase64-decodepy-urllib-requestchild-process-spawnpublic-github-pushreads-homedir+1

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

30.4 MB

versions

AUTO-PUBLISHED/npm/2023-07-21/MAL-2026-4014

@antv/gi-public-data@1.0.1

by pomelo-nwu

G6VP public data

→ sends tohttps://github.com/antvis/G6VP.git

public-github-pusharchive-then-upload

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

1.2 MB

versions

AUTO-PUBLISHED/npm/2023-03-11/MAL-2026-4013

@antv/gi-mock-data@1.0.5

by pomelo-nwu

G6VP MOCK DATA

→ sends tohttps://github.com/antvis/G6VP.git

public-github-pusharchive-then-upload

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

weekly

/wk

llm verdict

benign 0.85

h-score

patterns

size

282.5 KB

versions