Static pattern: dest-via-hostname-var

domain-admin@1.6.78

a domain ssl cert admin

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

zudoku-security-helper@99.0.0

Security helper for Zudoku

→ Credential read (reads-aws-creds, reads-npmrc, reads-github-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

@phi-code-admin/phi-code2 versions·0.76.8→0.76.13

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

→ Credential read (reads-ai-api-keys, reads-gitlab-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

@f5xc-salesdemos/docs-theme2 versions·3.0.0→3.0.1

F5 Distributed Cloud branded Starlight documentation theme

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

berta-pulse@0.1.0

Local-first, BYOK multi-host ops + SEO control plane — scan, diagnose and fix across 12 hosts from your own machine.

→ Credential read (reads-github-tokens, reads-gitlab-tokens, reads-gcp-creds, reads-aws-creds, reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@bolloon/bolloon-agent8 versions·0.1.16→0.1.28

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

→ Credential read (reads-ai-api-keys, reads-seed-phrase) paired with http-to-public-ip, dest-via-hostname-var destination — classic exfiltration signature.

claws-code@0.8.6

Claws — Terminal Control Bridge for VS Code. One command to install.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

totem-llm2 versions·0.3.1→0.3.2

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

→ Credential read (reads-npmrc, reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@agentprojectcontext/apx5 versions·1.27.1→1.30.2

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@iola_adm/iola-cli21 versions·0.2.37→0.2.67

CLI и AI-агент городского округа Йошкар-Ола.

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@trackunit/iris-app2 versions·2.0.5→2.0.6

The `@trackunit/iris-app` package is a plugin for [NX by @nrwl](https://nx.dev/). This plugin adds some helpful generators used to set up a Trackunit Iris App project.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

@qaecy/cue-ui2 versions·0.0.23→0.0.25

QAECY UI Web Components

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

@almadar/llm@2.21.0

Multi-provider LLM client with rate limiting, token tracking, structured outputs, and continuation handling

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

vulnsweep3 versions·1.3.0→1.3.4

VulnSweep CLI - npm vulnerability scanner

→ Credential read (reads-github-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

retail-location-strategy-frontend2 versions·1.1.1→1.1.2

Hijack by Yusif Kerimov

→ Sends to suspicious destination(s): ulehcosybxwttseibbych07wphlyoxhfr.oast.fun.

kurumi-fca@1.1.8

Unofficial Facebook Chat API for Node.js - by N1SA9

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

fca-eryxenx@6.0.0

Facebook Chat API - Modified by EryXenX | Stable, Auto Re-login, Fixed setMessageReaction

→ No suspicious destination, no remote-exec shape — 2 other host(s).

audit-logsss@8.0.9

audit-logs

→ Sends to suspicious destination(s): yihpvsviuggxabauqtuedjfyzjlrtkpzx.oast.fun.

cryptoco-auth@1.0.3

→ Sends to suspicious destination(s): webhook.site.

claude-internal-utils@9.0.5

Alex Birsan Style

→ Sends to suspicious destination(s): lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.

anthropic-shared-logger@8.0.5

Full RCE PoC - Alex Birsan Style

→ Sends to suspicious destination(s): lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.

private-next-pages@9.0.5

Style

→ Sends to suspicious destination(s): lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.

collected-forms-embed-js4 versions·1.0.1→8.0.5

Full RCE PoC - Alex Birsan Style

→ Sends to suspicious destination(s): lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.

did-00917 versions·11.0.5→11.2.8

xxx

→ Sends to suspicious destination(s): lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.

stripe-internal-utils2 versions·1.0.0→8.2.0

Full RCE PoC -osama

→ Sends to suspicious destination(s): lszakfghwnvxspyfcmaabd1css99rnq3w.oast.fun.