Static pattern: claude-agent-config-injection — 1 caught | Cremit

AUTO-PUBLISHED/kitchen-sink · 11/npm/2026-06-07

ltcai9 versions·1.3.0→3.1.0

by taesoopark

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

steals →Seed phrasenpm tokenPyPI tokenGitHub PATAI API keysKeePassDiscord tokensChromium logins

reads-env-varschild-process-spawncurl-pipe-bashpy-sys-platform-branchreads-github-tokensreads-ai-api-keysreads-chromium-credsreads-keepass+18

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

15.8 MB

versions

AUTO-PUBLISHED/kitchen-sink · 21/npm/2026-06-06

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

by dotcoocoo

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

steals →Crypto walletSeed phrasenpm tokenPyPI tokenCargo credsAWS keysGCP credsAzure credsGitHub PATKubeconfigDocker authSSH keysAI API keysMCP configmacOS Keychain1PasswordSlack tokensChromium logins→ sends tohttps://exceptd.com

clipboard-accessreads-env-varspublic-github-pushchild-process-spawnreads-github-tokensreads-homedirreads-ai-api-keysreads-system-info+26

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

weekly

—

/wk

llm verdict

malicious 0.96

h-score

patterns

size

35.0 MB

versions

292

AUTO-PUBLISHED/kitchen-sink · 9/npm/2026-06-05

claws-code@0.8.6

by neunaha

Claws — Terminal Control Bridge for VS Code. One command to install.

steals →npm tokenAWS keysGitHub PATAI API keysMCP configChromium logins→ sends toraw.githubusercontent.com · https://raw.githubusercontent.com/neunaha/claws/main/scr…

reads-env-varsreads-aws-credsreads-npmrcreads-github-tokensreads-ai-api-keysreads-homedirchild-process-spawninstall-path-npm-publish+8

weekly

—

/wk

llm verdict

malicious 0.96

h-score

patterns

size

13.6 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

cue-ai2 versions·0.9.0→0.9.2

by imdeadpool

cue — Agent Profile Manager for Claude Code & Codex. Pick a profile, launch with the right skills, MCPs, and plugins.

steals →MCP config→ sends tohttps://github.com/opencue/cuecards

public-github-pushcurl-pipe-bashbun-runtime-bootstrapreads-env-varschild-process-spawnreads-mcp-configreads-homedirclaude-agent-config-injection+3

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

42.2 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

ai-engineering-harness2 versions·0.11.0→1.0.1

by davidtruong170621

Engineering discipline and workflow guardrails for AI coding agents (Claude, Cursor, Codex, Gemini).

steals →MCP config→ sends toraw.githubusercontent.com · https://raw.githubusercontent.com/truongnat/ai-engineeri…

reads-mcp-configcurl-pipe-bashclaude-agent-config-injectionarchive-then-uploadchild-process-spawn

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.3 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

@agentprojectcontext/apx5 versions·1.27.1→1.30.2

by tecnomanu

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

steals →AI API keysMCP config→ sends tohttp://localhost:7431

public-github-pushclipboard-accessreads-env-varsreads-ai-api-keysbase64-decodechild-process-spawnreads-homedirreads-mcp-config+4

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

10.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

code-notify2 versions·1.8.0→1.9.0

by myungeun2

Desktop notifications for Claude Code, OpenAI Codex, and Gemini CLI

steals →MCP configChromium logins→ sends tohttps://github.com/mylee04/code-notify#readme

public-github-pushreads-homedirchild-process-spawnreads-env-varsdiscord-webhookreads-mcp-configreads-system-infoclaude-agent-config-injection+2

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

349.2 KB

versions

AUTO-PUBLISHED/kitchen-sink · 11/npm/2026-05-26/MAL-2026-4497

bingocode@1.1.150

by leanchy

steals →npm tokenGCP credsAWS keysAzure credsGitHub PATSSH keysAI API keysMCP configmacOS Keychain

reads-env-varsfs-recursive-readreads-ai-api-keysclaude-agent-config-injectionchild-process-spawnreads-gcp-credsreads-keychainreads-npmrc+9

→ No suspicious destination, no remote-exec shape — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

34.9 MB

versions

123