Long base64 literal (likely encoded payload)

domain-admin@1.6.78

a domain ssl cert admin

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

@yuechou/pi-ai4 versions·15.8.3-patched.1→15.8.3-patched.6

Unified LLM API with automatic model discovery and provider configuration

weavedb-lite2 versions·0.1.0→0.1.1

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@aztec/end-to-end@4.3.1

This package includes end-to-end tests that cover Aztec's main milestones. These can be run locally either by starting anvil on a different terminal.

@aztec/ethereum@4.3.1

This package provides configuration and code for common chain operations such as contract deployment etc.

youtube-downloader-web@1.0.0

A professional full-stack YouTube Downloader powered by yt-dlp.

→ Credential read (reads-apple-cloudkit) paired with http-to-public-ip destination — classic exfiltration signature.

@qaecy/cue-ui2 versions·0.0.23→0.0.25

QAECY UI Web Components

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

nolimit-x@1.0.232

Advanced email sender

finkrouter@1.1.1

FINK Orchestrator Core - Enterprise Installer

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/vendor@1.0.11

Vendored dependencies to fix ERR_REQUIRE_ESM.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/gi-assets-galaxybase@1.2.15

Galaxybase 团队的图分析资产包

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).