// Data staging
pattern: py-pip-install-runtime
Packages whose static analysis matched this pattern. See the per-package detail pages for the offending code excerpt.
25 packages flagged with this pattern (51 total publish events, collapsed by publisher+name). Newest first.
Autonomous CVE remediation system with AI patching, runtime validation, KinD testing, and zero-trust deployment gates.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
a domain ssl cert admin
→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.
Open-source coding-agent CLI. Terminal-first, multi-agent, self-improving. Supports OpenAI, Anthropic, Gemini, Ollama, and 13 more providers.
→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.
Shared rootfs contract parsing, reference profile assets, and build helpers.
Node and GitHub Actions adapters for shared Aleph tooling.
AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,
→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.
cue — Agent Profile Manager for Claude Code & Codex. Pick a profile, launch with the right skills, MCPs, and plugins.
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
Project subsystem bootstrapper CLI
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
JishuShell — Raspberry Pi server management panel (Core + Web UI)
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
logging step
→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.
A Python package for Azure Genome.
Tricentis Sealights Python Agent - Quality Intelligence and Code Coverage
A professional full-stack YouTube Downloader powered by yt-dlp.
→ Credential read (reads-apple-cloudkit) paired with http-to-public-ip destination — classic exfiltration signature.
Real-time music generation models.
Module for Quick Calculations
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).
EPL - English Programming Language: write code in plain English. Build apps, web servers, and more.
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 2 other host(s).
AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
KIVO — Agent 知识平台，覆盖知识提取、存储、检索、迭代、调研、图谱、工作台全生命周期
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
AI Agent CLI — native function calling · GEMINI.md context · extensions
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
LiteLLM router-based LLM provider for AgentForge — 100+ underlying providers through one interface
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
通达信 TCP 协议行情数据客户端，支持在线行情与离线本地数据读取
→ Hardcoded public IP destination: 180.153.18.170, 124.71.187.122, 180.153.18.171, 180.153.18.172, 119.147.212.81, 115.238.56.198, 115.238.90.165, 218.75.126.9, 47.107.75.159, 59.175.238.38, 110.41.147.114, 110.41.2.72, 101.33.225.16, 175.178.112.197, 175.178.128.227, 43.139.95.83, 124.223.163.242, 122.51.120.217, 150.158.160.2, 123.60.164.122, 111.229.247.189, 124.70.199.56, 62.234.50.143, 81.70.151.186, 82.156.214.79, 159.75.29.111, 43.139.18.171, 81.71.32.47, 122.51.232.182, 118.25.98.114, 121.36.225.169, 123.60.70.228, 123.60.73.44, 124.70.133.119, 124.71.187.72, 119.97.185.59, 129.204.230.128, 101.42.240.54, 124.71.9.153, 123.60.84.66, 111.230.186.52, 101.0.0.43 (not RFC1918 / loopback).
A Durable Task Client SDK for Python
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
Tiny security gate for CI/CD — orchestrates Semgrep, Gitleaks, osv-scanner, Trivy, and npm audit with a premium HTML report.
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
