// Code execution / obfuscation

Static pattern: long-hex-literal

pattern: long-hex-literal

Packages whose static analysis matched this pattern. See the per-package detail pages for the offending code excerpt.

4 packages flagged with this pattern (5 total publish events, collapsed by publisher+name). Newest first.

• AUTO-PUBLISHED/pypi/2026-06-07

  domain-admin@1.6.78

  by Peng Shiyu

  a domain ssl cert admin

  steals →Chromium logins→ sends tohttps://pypi.org/simple

  child-process-spawnpy-pip-install-runtimereads-env-varspy-requests-postpy-socket-connectlong-base64-literallong-hex-literalclipboard-access
• AUTO-PUBLISHED/npm/2026-06-04

  @aztec/end-to-end@4.3.1

  by charlielye

  This package includes end-to-end tests that cover Aztec's main milestones. These can be run locally either by starting anvil on a different terminal.

  steals →Seed phrase

  child-process-spawnreads-env-varsreads-seed-phrasebase64-decodelong-base64-literalhex-decodelong-hex-literal

  weekly

  —
• AUTO-PUBLISHED/npm/2026-06-04

  @qaecy/cue-ui2 versions·0.0.23→0.0.25

  by madsholten

  QAECY UI Web Components

  → sends tohttps://docs.mapbox.com/mapbox-gl-js/guides/install/#transpiling

  reads-env-varsbase64-decodechild-process-spawnpastebin-domainfunction-constructorlong-base64-literalclipboard-accesslong-hex-literal+2
• AUTO-PUBLISHED/npm/2025-04-21/MAL-2026-4093

  @antv/vendor@1.0.11

  by bqxbqxbqx

  Vendored dependencies to fix ERR_REQUIRE_ESM.

  → sends tohttps://github.com/d3/d3-dispatch/blob/main/LICENSE

  child-process-spawnlong-base64-literallong-hex-literal

  → No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

  weekly

  —

  /wk

  llm verdict

  benign