Static pattern: py-urllib-request

ltcai12 versions·0.1.29→3.1.0

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

purpclaw5 versions·0.1.0→0.1.4

Open-source coding-agent CLI. Terminal-first, multi-agent, self-improving. Supports OpenAI, Anthropic, Gemini, Ollama, and 13 more providers.

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

@le-space/rootfs@0.3.12

Shared rootfs contract parsing, reference profile assets, and build helpers.

@le-space/node@0.3.12

Node and GitHub Actions adapters for shared Aleph tooling.

@delorenj/pjangler2 versions·1.1.3→1.1.5

Project subsystem bootstrapper CLI

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@ngocsangairvds/vsaf@4.2.9

logging step

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

azure-genome@0.1.4

A Python package for Azure Genome.

sealights-python-agent@2.10.10

Tricentis Sealights Python Agent - Quality Intelligence and Code Coverage

youtube-downloader-web@1.0.0

A professional full-stack YouTube Downloader powered by yt-dlp.

→ Credential read (reads-apple-cloudkit) paired with http-to-public-ip destination — classic exfiltration signature.

qontract-reconcile@0.10.2.dev658

Collection of tools to reconcile services with their desired state as defined in the app-interface DB.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

eplang@8.0.0

EPL - English Programming Language: write code in plain English. Build apps, web servers, and more.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 2 other host(s).

edison-tools@0.1.17

→ No suspicious destination, no remote-exec shape — 1 other host(s).

aurafarmer@0.3.0

PRO — Terminal AI Coding Agent by SPRUKY

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

openclaw-cn@0.2.0

Openclaw 中文版 - WhatsApp gateway CLI (Baileys web) with Pi RPC agent

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).