Static pattern: child-process-spawn

ltcai2 versions·2.2.7→3.1.0

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@checkstack/backend4 versions·0.16.0→0.18.0

@checkstack/common2 versions·0.13.0→0.15.0

domain-admin@1.6.78

a domain ssl cert admin

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

@phi-code-admin/phi-code2 versions·0.76.8→0.76.13

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

→ Credential read (reads-ai-api-keys, reads-gitlab-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

purpclaw5 versions·0.1.0→0.1.4

Open-source coding-agent CLI. Terminal-first, multi-agent, self-improving. Supports OpenAI, Anthropic, Gemini, Ollama, and 13 more providers.

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

@f5xc-salesdemos/docs-theme2 versions·3.0.0→3.0.1

F5 Distributed Cloud branded Starlight documentation theme

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@spcsn/taro2 versions·1.0.0→1.0.1

SPCSN Taro runtime API entry

berta-pulse@0.1.0

Local-first, BYOK multi-host ops + SEO control plane — scan, diagnose and fix across 12 hosts from your own machine.

→ Credential read (reads-github-tokens, reads-gitlab-tokens, reads-gcp-creds, reads-aws-creds, reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@bolloon/bolloon-agent3 versions·0.1.24→0.1.28

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

→ Credential read (reads-ai-api-keys, reads-seed-phrase) paired with http-to-public-ip, dest-via-hostname-var destination — classic exfiltration signature.

@le-space/rootfs@0.3.12

Shared rootfs contract parsing, reference profile assets, and build helpers.

@le-space/node@0.3.12

Node and GitHub Actions adapters for shared Aleph tooling.

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

ethsmith@1.0.0

Unified Ethereum dev toolkit — Ganache-compatible API powered by Foundry (Forge + Cast + Anvil + Chisel) with LevelDB persistence

rtexit-method3 versions·0.1.26→0.1.28

RTExit - AI-assisted Red Team methodology installer

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@agenticmail/enterprise@0.5.615

AgenticMail Enterprise — cloud-hosted AI agent identity, email, auth & compliance for organizations

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

claws-code@0.8.6

Claws — Terminal Control Bridge for VS Code. One command to install.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

@xemahq/kernel-contracts2 versions·0.2.0→0.2.1

Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the 32 kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.

@jacob-ebey/almostnode@0.4.0

Node.js in your browser. Just like that.

→ Credential read (reads-ai-api-keys) paired with http-to-public-ip destination — classic exfiltration signature.

@actagent/acpx@2026.6.2

ACTAgent ACP runtime backend with plugin-owned session and transport management.

@actagent/amazon-bedrock-provider@2026.6.2

ACTAgent Amazon Bedrock provider plugin with model discovery, embeddings, and guardrail support.

cue-ai@0.9.2

cue — Agent Profile Manager for Claude Code & Codex. Pick a profile, launch with the right skills, MCPs, and plugins.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@start.dev/almostnode2 versions·0.3.0→0.3.1

Node.js in your browser. Just like that.

→ Credential read (reads-ai-api-keys) paired with http-to-public-ip destination — classic exfiltration signature.

ciphernest2 versions·0.4.0→0.8.4

AI-aware security scanner for VS Code — code vulnerabilities, LLM risks, secrets, dependencies, MCP & agent security

→ Credential read (reads-github-tokens, reads-aws-creds, reads-ai-api-keys, reads-azure-creds) paired with webhook-bin destination — classic exfiltration signature.

@oml/cli@0.20.1

The cli specific package

forge-jsx2@1.0.126

Node.js integration layer for Autodesk Forge

harper@5.0.28

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

→ Credential read (reads-aws-creds) paired with http-to-public-ip destination — classic exfiltration signature.

@harperfast/harper@5.0.28

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

→ Credential read (reads-aws-creds) paired with http-to-public-ip destination — classic exfiltration signature.

@delorenj/pjangler2 versions·1.1.3→1.1.5

Project subsystem bootstrapper CLI

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@fleetagent/pi-coding-agent@0.0.8

Coding agent CLI with read, bash, edit, write tools and session management

jishushell@0.6.5

JishuShell — Raspberry Pi server management panel (Core + Web UI)

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@yuechou/pi-ai3 versions·15.8.3-patched.4→15.8.3-patched.6

Unified LLM API with automatic model discovery and provider configuration

@yuechou/pi-coding-agent3 versions·15.8.3-patched.4→15.8.3-patched.6

Coding agent CLI with read, bash, edit, write tools and session management

@reconcrap/boss-recommend-mcp3 versions·2.1.10→2.1.12

Unified MCP pipeline for recommend-page filtering and screening on Boss Zhipin

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

totem-llm2 versions·0.3.1→0.3.2

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

→ Credential read (reads-npmrc, reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

ai-engineering-harness@1.0.1

Engineering discipline and workflow guardrails for AI coding agents (Claude, Cursor, Codex, Gemini).

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@ngocsangairvds/vsaf@4.2.9

logging step

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@ethlete/cli@2.0.1

microsoft-applicationinsights-common@3.4.2

Microsoft Application Insights Common JavaScript Library

weavedb-warp-contracts-plugin-deploy@1.0.10

A deploy plugin for warp contracts

weavedb-tools@0.45.2

weavedb-contracts@0.45.3

wdb-sdk@0.1.1

wdb-core@0.1.1

wdb-cli@0.1.0

warp-contracts-plugin-deploy-test@3.0.0

A deploy plugin for warp contracts

monade@0.0.8

hbsig@0.3.3

[Documentation](../docs/docs/pages/api/hbsig.mdx)

cwao-tools@0.3.0

`cwao-tools` makes CosmWasm contract development & testing too easy.

create-arnext-app@0.0.9

atomic-notes@0.5.2

aonote@0.11.0

@agentprojectcontext/apx5 versions·1.27.1→1.30.2

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

azure-genome@0.1.4

A Python package for Azure Genome.

openclaw-foundry-core@1.0.0

The forge that forges itself — self-writing meta-extension for OpenClaw

→ Credential read (reads-ai-api-keys) paired with webhook-bin destination — classic exfiltration signature.

sealights-python-agent@2.10.10

Tricentis Sealights Python Agent - Quality Intelligence and Code Coverage

code-notify@1.9.0

Desktop notifications for Claude Code, OpenAI Codex, and Gemini CLI

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@iola_adm/iola-cli@0.2.67

CLI и AI-агент городского округа Йошкар-Ола.

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@aztec/cli@4.3.1

The Aztec CLI `aztec-cli` is a command-line interface (CLI) tool for interacting with Aztec. It provides various commands for deploying contracts, creating accounts, interacting with contracts, and retrieving blockchain data.

@aztec/aztec@4.3.1

Aztec is a package that allows for a simple development environment on Aztec stack. It creates a Private eXecution Environment (PXE) that listens for HTTP requests on `localhost:8080` by default. When started, it deploys all necessary L1 Aztec contracts a

@aztec/end-to-end@4.3.1

This package includes end-to-end tests that cover Aztec's main milestones. These can be run locally either by starting anvil on a different terminal.

@aztec/foundation@4.3.1

@aztec/ethereum@4.3.1

This package provides configuration and code for common chain operations such as contract deployment etc.

epyt@2.3.5.1

EPyT: An EPANET-Python Toolkit for Smart Water Network Simulations. The EPyT is inspired by the EPANET-Matlab Toolkit.

→ Credential read (reads-pypirc) paired with http-to-public-ip destination — classic exfiltration signature.

nodmix2 versions·2026.5.34→2026.5.35

Nodmix, the Supreme CEO Founder AI Agent. A large language model created and developed by Mehdi Faraj.

→ Credential read (reads-ai-api-keys) paired with pastebin-domain destination — classic exfiltration signature.

@ottocode/server@0.1.298

HTTP API server for ottocode