Static pattern: install-path-npm-publish

ltcai12 versions·0.1.29→3.1.0

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

claws-code@0.8.6

Claws — Terminal Control Bridge for VS Code. One command to install.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

free-email-domains3 versions·1.9.22→1.9.26

A comprehensive list of all free email domain providers

@trackunit/iris-app2 versions·2.0.5→2.0.6

The `@trackunit/iris-app` package is a plugin for [NX by @nrwl](https://nx.dev/). This plugin adds some helpful generators used to set up a Trackunit Iris App project.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

verce2vue2test@0.1.0

This template should help get you started developing with Vue 3 in Vite.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

cli-jaw@2.1.3

Personal AI assistant powered by Antigravity, AI-E, Claude, Claude E, Codex, Codex App, Cursor, Gemini, Grok, OpenCode, and Copilot — Web, Terminal, Telegram, and Discord interfaces with 107 built-in skills

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

pokebedrock-showdown@0.1.17

A modified version of the Pokémon Showdown server, designed for PokeBedrock.

→ Credential read (reads-azure-creds) paired with pastebin-domain destination — classic exfiltration signature.

omnius@1.0.200

AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

claw-subagent-service@0.0.153

虾说智能助手

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

cdk-insights@1.41.2

AWS CDK security and cost analysis CLI. Free static scans via npm — no account needed. Sign up free to add AI-powered insights.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@kruzer/lib-ui@0.0.0-alpha.555

This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@lint-md/core@2.0.0

Core of lint-md which used to lint your markdown file for Chinese.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/mcp-server-antv@0.1.8

MCP Server for AntV visualization libraries development, which provides documentation context and examples for visualization developers.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/layout-gpu@1.1.7

graph layout algorithm implemented with GPGPU

→ No suspicious destination, no remote-exec shape — 2 known-vendor host(s).

@antv/l7-react@2.4.3

L7-React 已全面 升级为 LarkMap,不在进行维护 。 LarkMap 空间数据可视分析组件库

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

@antv/l7-pass@1.0.0

## Getting Started

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/l7-editor@1.1.13

Geographic data editing tool based on L7

@antv/l7-draw@3.1.5

A drawing package for L7

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/g6-react-node@1.4.8

Using React Component to Define Your G6 Graph Node

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/dipper-map@1.0.10

在线 Demo 地址: https://antv.vision/DipperMap/demo

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

@antv/dipper-hooks@0.2.1

## Getting Started

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/dipper-component@0.0.4

## Getting Started

→ No suspicious destination, no remote-exec shape — 3 known-vendor host(s).