// Data staging

Static pattern: bun-runtime-bootstrap

pattern: bun-runtime-bootstrap

Packages whose static analysis matched this pattern. See the per-package detail pages for the offending code excerpt.

4 packages flagged with this pattern (5 total publish events, collapsed by publisher+name). Newest first.

• AUTO-PUBLISHED/npm/2026-06-05

  cue-ai2 versions·0.9.0→0.9.2

  by imdeadpool

  cue — Agent Profile Manager for Claude Code & Codex. Pick a profile, launch with the right skills, MCPs, and plugins.

  steals →MCP config→ sends tohttps://github.com/opencue/cuecards

  public-github-pushcurl-pipe-bashbun-runtime-bootstrapreads-env-varschild-process-spawnreads-mcp-config
• AUTO-PUBLISHED/npm/2026-06-04

  @metamask/skills@0.1.0

  by metamaskbot

  Shared MetaMask agent skills installer and sync CLI.

  → sends tohttps://registry.npmjs.org/

  public-github-pushcurl-pipe-bashbun-runtime-bootstrap

  → Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

  weekly

  —

  /wk

  llm verdict

  malicious 0.95
• AUTO-PUBLISHED/npm/2026-05-29

  @agentuity/cli@2.0.23

  by huijiro

  steals →GitHub PATAI API keys

  reads-env-varschild-process-spawnbase64-decodereads-ai-api-keysclipboard-accessreads-homedirarchive-then-uploadbun-runtime-bootstrap+2

  → No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

• AUTO-PUBLISHED/npm/2026-05-26/MAL-2026-4398

  @jonusnattapong/claudecode@2.1.178

  by jonusnattapong

  Official Claude Code CLI — AI-powered coding assistant

  → sends tohttps://github.com/JonusNattapong/claudecode.git

  public-github-pushchild-process-spawnbun-runtime-bootstrap

  → No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

  weekly

  —

  /wk

  llm verdict