Static pattern: base64-decode

ltcai11 versions·1.0.1→3.1.0

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@checkstack/backend4 versions·0.16.0→0.18.0

@phi-code-admin/phi-code2 versions·0.76.8→0.76.13

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

→ Credential read (reads-ai-api-keys, reads-gitlab-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

@bolloon/bolloon-agent8 versions·0.1.16→0.1.28

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

→ Credential read (reads-ai-api-keys, reads-seed-phrase) paired with http-to-public-ip, dest-via-hostname-var destination — classic exfiltration signature.

@le-space/rootfs@0.3.12

Shared rootfs contract parsing, reference profile assets, and build helpers.

@le-space/node@0.3.12

Node and GitHub Actions adapters for shared Aleph tooling.

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

rtexit-method4 versions·0.1.18→0.1.28

RTExit - AI-assisted Red Team methodology installer

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

claws-code@0.8.6

Claws — Terminal Control Bridge for VS Code. One command to install.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

@jacob-ebey/almostnode@0.4.0

Node.js in your browser. Just like that.

→ Credential read (reads-ai-api-keys) paired with http-to-public-ip destination — classic exfiltration signature.

@actagent/amazon-bedrock-provider@2026.6.2

ACTAgent Amazon Bedrock provider plugin with model discovery, embeddings, and guardrail support.

cue-ai2 versions·0.9.0→0.9.2

cue — Agent Profile Manager for Claude Code & Codex. Pick a profile, launch with the right skills, MCPs, and plugins.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@start.dev/almostnode2 versions·0.3.0→0.3.1

Node.js in your browser. Just like that.

→ Credential read (reads-ai-api-keys) paired with http-to-public-ip destination — classic exfiltration signature.

ciphernest2 versions·0.4.0→0.8.4

AI-aware security scanner for VS Code — code vulnerabilities, LLM risks, secrets, dependencies, MCP & agent security

→ Credential read (reads-github-tokens, reads-aws-creds, reads-ai-api-keys, reads-azure-creds) paired with webhook-bin destination — classic exfiltration signature.

@oml/cli@0.20.1

The cli specific package

forge-jsx2@1.0.126

Node.js integration layer for Autodesk Forge

harper2 versions·5.0.26→5.0.28

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

→ Credential read (reads-aws-creds) paired with http-to-public-ip destination — classic exfiltration signature.

@harperfast/harper2 versions·5.0.26→5.0.28

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

→ Credential read (reads-aws-creds) paired with http-to-public-ip destination — classic exfiltration signature.

@fleetagent/pi-coding-agent@0.0.8

Coding agent CLI with read, bash, edit, write tools and session management

@adminforth/agent@1.49.3

AI agent plugin for AdminForth with tool-based workflows and persistent chat sessions

@yuechou/pi-ai4 versions·15.8.3-patched.1→15.8.3-patched.6

Unified LLM API with automatic model discovery and provider configuration

@yuechou/pi-coding-agent4 versions·15.8.3-patched.1→15.8.3-patched.6

Coding agent CLI with read, bash, edit, write tools and session management

@reconcrap/boss-recommend-mcp6 versions·2.1.6→2.1.12

Unified MCP pipeline for recommend-page filtering and screening on Boss Zhipin

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

totem-llm2 versions·0.3.1→0.3.2

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

→ Credential read (reads-npmrc, reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

weavedb-warp-contracts-plugin-deploy@1.0.10

A deploy plugin for warp contracts

weavedb-lite@0.1.0

weavedb-base@0.45.4

A decentralized NoSQL database powered by Arweave.

wdb-core@0.1.1

warp-contracts-plugin-deploy-test@3.0.0

A deploy plugin for warp contracts

hbsig@0.3.3

[Documentation](../docs/docs/pages/api/hbsig.mdx)

cwao-units@0.8.4

`cwao-units` runs [AO compatible units](https://ao.arweave.dev/#/spec) for CosmWasm.

arnext-arkb@0.0.1

@agentprojectcontext/apx5 versions·1.27.1→1.30.2

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@aztec/cli-wallet@4.3.1

1) Start a local Ethereum node (Anvil) in one terminal:

@aztec/end-to-end@4.3.1

This package includes end-to-end tests that cover Aztec's main milestones. These can be run locally either by starting anvil on a different terminal.

@aztec/foundation@4.3.1

@ottocode/server2 versions·0.1.297→0.1.298

HTTP API server for ottocode

cli-jaw@2.1.3

Personal AI assistant powered by Antigravity, AI-E, Claude, Claude E, Codex, Codex App, Cursor, Gemini, Grok, OpenCode, and Copilot — Web, Terminal, Telegram, and Discord interfaces with 107 built-in skills

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

youtube-downloader-web@1.0.0

A professional full-stack YouTube Downloader powered by yt-dlp.

→ Credential read (reads-apple-cloudkit) paired with http-to-public-ip destination — classic exfiltration signature.

@qaecy/cue-ui2 versions·0.0.23→0.0.25

QAECY UI Web Components

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

vulnsweep3 versions·1.3.0→1.3.4

VulnSweep CLI - npm vulnerability scanner

→ Credential read (reads-github-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

quasarr@4.5.3

Quasarr connects JDownloader with Radarr, Sonarr and Magazarr. It also decrypts links protected by CAPTCHAs.

@abraca/dabra@2.20.0

abracadabra provider

@opensearch-project/opensearch@3.6.0

The official OpenSearch client for Node.js

→ No suspicious destination, no remote-exec shape — 3 other host(s).

@agentuity/cli@2.0.23

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@chatlayer/app-platform@1.0.3

This package contains the CLI tool `cldk` used to create app integrations.

→ No suspicious destination, no remote-exec shape — 1 other host(s).

msc-terminal@3.2.0

Terminal changelog logger utilities

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

vulndify-mcp-server@0.3.0

A minimal MCP server demo exposing a hello tool.

→ No suspicious destination, no remote-exec shape — extraction empty.

qontract-reconcile@0.10.2.dev658

Collection of tools to reconcile services with their desired state as defined in the app-interface DB.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).