Static pattern: public-github-push

ltcai3 versions·2.2.2→3.1.0

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@phi-code-admin/phi-code2 versions·0.76.8→0.76.13

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

→ Credential read (reads-ai-api-keys, reads-gitlab-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

purpclaw5 versions·0.1.0→0.1.4

Open-source coding-agent CLI. Terminal-first, multi-agent, self-improving. Supports OpenAI, Anthropic, Gemini, Ollama, and 13 more providers.

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

@spcsn/taro2 versions·1.0.0→1.0.1

SPCSN Taro runtime API entry

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

ethsmith@1.0.0

Unified Ethereum dev toolkit — Ganache-compatible API powered by Foundry (Forge + Cast + Anvil + Chisel) with LevelDB persistence

rtexit-method4 versions·0.1.18→0.1.28

RTExit - AI-assisted Red Team methodology installer

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@agenticmail/enterprise@0.5.615

AgenticMail Enterprise — cloud-hosted AI agent identity, email, auth & compliance for organizations

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@proof-computer/proof-cli-switchboard5 versions·0.2.4→0.2.8

Switchboard plugin for the PROOF command line interface.

@jacob-ebey/almostnode@0.4.0

Node.js in your browser. Just like that.

→ Credential read (reads-ai-api-keys) paired with http-to-public-ip destination — classic exfiltration signature.

cue-ai@0.9.2

cue — Agent Profile Manager for Claude Code & Codex. Pick a profile, launch with the right skills, MCPs, and plugins.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@start.dev/almostnode2 versions·0.3.0→0.3.1

Node.js in your browser. Just like that.

→ Credential read (reads-ai-api-keys) paired with http-to-public-ip destination — classic exfiltration signature.

ciphernest@0.8.4

AI-aware security scanner for VS Code — code vulnerabilities, LLM risks, secrets, dependencies, MCP & agent security

→ Credential read (reads-github-tokens, reads-aws-creds, reads-ai-api-keys, reads-azure-creds) paired with webhook-bin destination — classic exfiltration signature.

harper2 versions·5.0.26→5.0.28

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

→ Credential read (reads-aws-creds) paired with http-to-public-ip destination — classic exfiltration signature.

@harperfast/harper2 versions·5.0.26→5.0.28

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

→ Credential read (reads-aws-creds) paired with http-to-public-ip destination — classic exfiltration signature.

@adminforth/completion-adapter-openai-responses@1.0.2

AdminForth completion adapter for the OpenAI Responses API.

@consentmo/consentmo-hydrogen@1.1.1

Consentmo cookie banner and Web Accessibility widget integration for Hydrogen storefronts.

@jagreehal/workflow@1.16.0

Typed async workflows with automatic error inference. Build type-safe workflows with Result types, step caching, resume state, and human-in-the-loop support.

@yuechou/pi-ai4 versions·15.8.3-patched.1→15.8.3-patched.6

Unified LLM API with automatic model discovery and provider configuration

@yuechou/pi-coding-agent4 versions·15.8.3-patched.1→15.8.3-patched.6

Coding agent CLI with read, bash, edit, write tools and session management

@reconcrap/boss-recommend-mcp6 versions·2.1.6→2.1.12

Unified MCP pipeline for recommend-page filtering and screening on Boss Zhipin

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

totem-llm2 versions·0.3.1→0.3.2

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

→ Credential read (reads-npmrc, reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@adia-ai/a2ui-corpus4 versions·0.7.9→0.7.12

AdiaUI A2UI training corpus — canonical v0.9 catalog + chunks + eval fixtures + feedback + gap registry. Consumed by the compose engine's retrieval layer + the MCP pipeline.

ms-graph-types@2.43.2

Types for Microsoft Graph objects

crypto-javascript@4.3.6

JavaScript library of crypto standards.

free-email-domains2 versions·1.9.25→1.9.26

A comprehensive list of all free email domain providers

weavedb-contracts@0.45.3

arjson@0.1.5

Bit-level JSON encoder + delta-chain protocol (weavepack-json reference implementation). Smaller than MessagePack/CBOR for structured/repetitive JSON; ships per-payload-addressable chains for storing edit histories.

@agentprojectcontext/apx5 versions·1.27.1→1.30.2

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@putout/cli-ruler@5.0.0

toggle rules in .putout.json

sealights-python-agent@2.10.10

Tricentis Sealights Python Agent - Quality Intelligence and Code Coverage

code-notify@1.9.0

Desktop notifications for Claude Code, OpenAI Codex, and Gemini CLI

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@iola_adm/iola-cli16 versions·0.2.45→0.2.67

CLI и AI-агент городского округа Йошкар-Ола.

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

nodmix4 versions·2026.5.30→2026.5.35

Nodmix, the Supreme CEO Founder AI Agent. A large language model created and developed by Mehdi Faraj.

→ Credential read (reads-ai-api-keys) paired with pastebin-domain destination — classic exfiltration signature.

@metamask/skills@0.1.0

Shared MetaMask agent skills installer and sync CLI.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

cli-jaw@2.1.3

Personal AI assistant powered by Antigravity, AI-E, Claude, Claude E, Codex, Codex App, Cursor, Gemini, Grok, OpenCode, and Copilot — Web, Terminal, Telegram, and Discord interfaces with 107 built-in skills

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@mettlecast/domain-cli3 versions·0.2.29→0.2.32

Local developer toolchain for TIB Domain Module projects. Provides build, validate, test, and dev subcommands.

@almadar/llm@2.21.0

Multi-provider LLM client with rate limiting, token tracking, structured outputs, and continuation handling

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

pokebedrock-showdown@0.1.17

A modified version of the Pokémon Showdown server, designed for PokeBedrock.

→ Credential read (reads-azure-creds) paired with pastebin-domain destination — classic exfiltration signature.

r2g@0.2.15

Semver-oriented TypeScript library skeleton.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.