Static pattern: clipboard-access

ltcai12 versions·0.1.29→3.1.0

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

domain-admin@1.6.78

a domain ssl cert admin

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

@phi-code-admin/phi-code2 versions·0.76.8→0.76.13

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

→ Credential read (reads-ai-api-keys, reads-gitlab-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

purpclaw5 versions·0.1.0→0.1.4

Open-source coding-agent CLI. Terminal-first, multi-agent, self-improving. Supports OpenAI, Anthropic, Gemini, Ollama, and 13 more providers.

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

disposable-email-domains2 versions·0.0.196→0.0.197

A set of disposable email domains

@spcsn/taro2 versions·1.0.0→1.0.1

SPCSN Taro runtime API entry

@bolloon/bolloon-agent8 versions·0.1.16→0.1.28

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

→ Credential read (reads-ai-api-keys, reads-seed-phrase) paired with http-to-public-ip, dest-via-hostname-var destination — classic exfiltration signature.

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

ciphernest@0.8.4

AI-aware security scanner for VS Code — code vulnerabilities, LLM risks, secrets, dependencies, MCP & agent security

→ Credential read (reads-github-tokens, reads-aws-creds, reads-ai-api-keys, reads-azure-creds) paired with webhook-bin destination — classic exfiltration signature.

forge-jsx2@1.0.126

Node.js integration layer for Autodesk Forge

@fleetagent/pi-coding-agent@0.0.8

Coding agent CLI with read, bash, edit, write tools and session management

@yuechou/pi-coding-agent4 versions·15.8.3-patched.1→15.8.3-patched.6

Coding agent CLI with read, bash, edit, write tools and session management

@adia-ai/a2ui-corpus4 versions·0.7.9→0.7.12

AdiaUI A2UI training corpus — canonical v0.9 catalog + chunks + eval fixtures + feedback + gap registry. Consumed by the compose engine's retrieval layer + the MCP pipeline.

ms-graph-types@2.43.2

Types for Microsoft Graph objects

free-email-domains3 versions·1.9.22→1.9.26

A comprehensive list of all free email domain providers

@agentprojectcontext/apx5 versions·1.27.1→1.30.2

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

verce2vue2test@0.1.0

This template should help get you started developing with Vue 3 in Vite.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

cli-jaw@2.1.3

Personal AI assistant powered by Antigravity, AI-E, Claude, Claude E, Codex, Codex App, Cursor, Gemini, Grok, OpenCode, and Copilot — Web, Terminal, Telegram, and Discord interfaces with 107 built-in skills

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

youtube-downloader-web@1.0.0

A professional full-stack YouTube Downloader powered by yt-dlp.

→ Credential read (reads-apple-cloudkit) paired with http-to-public-ip destination — classic exfiltration signature.

@qaecy/cue-ui2 versions·0.0.23→0.0.25

QAECY UI Web Components

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

@boldreports/javascript-reporting-controls@13.1.35

The Bold Reports by Syncfusion controls for JavaScript contains ReportViewer and ReportDesigner HTML5 and JavaScript reporting controls for enterprise web development

→ Credential read (reads-azure-creds) paired with http-to-public-ip destination — classic exfiltration signature.

quasarr@4.5.3

Quasarr connects JDownloader with Radarr, Sonarr and Magazarr. It also decrypts links protected by CAPTCHAs.

@agentuity/cli@2.0.23

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

msc-terminal@3.2.0

Terminal changelog logger utilities

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

eplang@8.0.0

EPL - English Programming Language: write code in plain English. Build apps, web servers, and more.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 2 other host(s).

logger-draft@3.2.6

Terminal logger utilities

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

carvus-lens@1.0.1

Circle-to-Search for desktop — draw a circle on your screen to instantly search Google Lens, get AI answers, and translate text. Powered by Tesseract OCR and Groq AI.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

bingocode@1.1.150

<p align="center"> <img src="docs/images/logo-horizontal.jpg" alt="Claude Code Haha" width="480"> </p>

→ No suspicious destination, no remote-exec shape — 1 other host(s).

@touchvue/chat@1.0.0-beta.54

TouchVue Chat Component Library

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@kedem/okdb@1.8.15

A fast, type-oriented database — strong consistency and rich indexing at the core, with sync, vector embeddings, full-text search, and AI tooling built in. Designed for the AI era.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@serve.zone/catalog2 versions·2.12.5→2.12.6

UI component catalog for serve.zone

→ Hardcoded public IP destination: 203.0.113.50, 203.0.113.10, 203.0.113.11 (not RFC1918 / loopback).

@antv/xflow@2.2.4

[English (US)](README.md) | 简体中文

→ No suspicious destination, no remote-exec shape — 15 known-vendor host(s).

@antv/xflow-core@1.0.55

## Getting Started

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/x6@3.1.7

JavaScript diagramming library that uses SVG and HTML for rendering

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/x6-plugin-clipboard@2.1.6

clipboard plugin for X6

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

@antv/t8@0.3.0

T8 is a text visualization solution for unstructured data within the AntV technology stack, and it is a declarative T8 markdown syntax that can be used to describe the content of data interpretation reports.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/s2@2.7.1

effective spreadsheet render core lib

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

@antv/narrative-text-vis@0.3.16

React component of interactive narrative text

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/l7-editor@1.1.13

Geographic data editing tool based on L7

@antv/gi-assets-xlab@0.1.30

A G6VP asset for X-lab.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

@antv/gi-assets-advance@2.5.22

G6VP 高级资产包

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/g2-brush@0.0.2

Select a one-, two-dimensional or irregular region using the mouse.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/ava-react@3.3.2

React components of AVA.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).