AI / LLM API key theft — 1 caught | Cremit · NHI Credential Stealer Index

AUTO-PUBLISHED/kitchen-sink · 11/npm/2026-06-07

ltcai6 versions·1.6.0→3.1.0

by taesoopark

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

steals →Seed phrasenpm tokenPyPI tokenGitHub PATAI API keysKeePassDiscord tokensChromium logins

reads-env-varschild-process-spawncurl-pipe-bashpy-sys-platform-branchreads-github-tokensreads-ai-api-keysreads-chromium-credsreads-keepass+18

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

15.8 MB

versions

AUTO-PUBLISHED/npm/2026-06-06

@phi-code-admin/phi-code2 versions·0.76.8→0.76.13

by phi-code-admin

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

steals →GitLab PATAI API keysChromium logins

public-github-pushclipboard-accessreads-env-varsreads-homedirreads-ai-api-keysreads-chromium-credschild-process-spawnreads-system-info+4

→ Credential read (reads-ai-api-keys, reads-gitlab-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

weekly

119

/wk

llm verdict

malicious 0.95

h-score

patterns

size

10.6 MB

versions

106

AUTO-PUBLISHED/gh-actions/2026-06-06

inference-gateway/infer-action18 versions·2026-05-31T22:44:14→2026-06-06T18:21:57

by inference-gateway

Github action for the Infer CLI

steals →GitHub PATAI API keys

reads-github-tokensreads-ai-api-keyscurl-pipe-bash

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

AUTO-PUBLISHED/kitchen-sink · 8/npm/2026-06-06

purpclaw5 versions·0.1.0→0.1.4

by rojoedjhdopdrhjzdhfojzdopthj

Open-source coding-agent CLI. Terminal-first, multi-agent, self-improving. Supports OpenAI, Anthropic, Gemini, Ollama, and 13 more providers.

steals →GitHub PATSSH keysAI API keysDiscord tokensSlack tokens

reads-env-varschild-process-spawnreads-ai-api-keyspublic-github-pushreads-homedirreads-system-inforeverse-shellclipboard-access+7

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

6.5 MB

versions

AUTO-PUBLISHED/npm/2026-06-06

@f5xc-salesdemos/docs-theme2 versions·3.0.0→3.0.1

by robinmordasiewicz

F5 Distributed Cloud branded Starlight documentation theme

steals →AI API keys

reads-env-varsreads-ai-api-keyschild-process-spawndest-via-hostname-var

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

weekly

788

/wk

llm verdict

malicious 0.95

h-score

patterns

size

367.5 KB

versions

AUTO-PUBLISHED/npm/2026-06-06

berta-pulse@0.1.0

by rondanini

Local-first, BYOK multi-host ops + SEO control plane — scan, diagnose and fix across 12 hosts from your own machine.

steals →GCP credsAWS keysGitHub PATGitLab PATAI API keys→ sends tohttps://${branchName}.${app.defaultDomain}

reads-github-tokensreads-gitlab-tokensreads-gcp-credsreads-aws-credsreads-env-varschild-process-spawnreads-ai-api-keysdest-via-hostname-var

→ Credential read (reads-github-tokens, reads-gitlab-tokens, reads-gcp-creds, reads-aws-creds, reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.6 MB

versions

AUTO-PUBLISHED/npm/2026-06-06

@bolloon/bolloon-agent8 versions·0.1.16→0.1.28

by leoyoge

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

steals →Seed phraseAI API keys

reads-ai-api-keyschild-process-spawnreads-env-varsreads-seed-phraseclipboard-accessbase64-decodehex-decodereads-homedir+3

→ Credential read (reads-ai-api-keys, reads-seed-phrase) paired with http-to-public-ip, dest-via-hostname-var destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

8.5 MB

versions

AUTO-PUBLISHED/kitchen-sink · 21/npm/2026-06-06

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

by dotcoocoo

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

steals →Crypto walletSeed phrasenpm tokenPyPI tokenCargo credsAWS keysGCP credsAzure credsGitHub PATKubeconfigDocker authSSH keysAI API keysMCP configmacOS Keychain1PasswordSlack tokensChromium logins→ sends tohttps://exceptd.com

clipboard-accessreads-env-varspublic-github-pushchild-process-spawnreads-github-tokensreads-homedirreads-ai-api-keysreads-system-info+26

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

weekly

—

/wk

llm verdict

malicious 0.96

h-score

patterns

size

35.0 MB

versions

292

AUTO-PUBLISHED/kitchen-sink · 9/npm/2026-06-05

claws-code@0.8.6

by neunaha

Claws — Terminal Control Bridge for VS Code. One command to install.

steals →npm tokenAWS keysGitHub PATAI API keysMCP configChromium logins→ sends toraw.githubusercontent.com · https://raw.githubusercontent.com/neunaha/claws/main/scr…

reads-env-varsreads-aws-credsreads-npmrcreads-github-tokensreads-ai-api-keysreads-homedirchild-process-spawninstall-path-npm-publish+8

weekly

—

/wk

llm verdict

malicious 0.96

h-score

patterns

size

13.6 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@jacob-ebey/almostnode@0.4.0

by jacob-ebey

Node.js in your browser. Just like that.

steals →AI API keysChromium logins→ sends tohttps://github.com/macaly/almostnode.git

public-github-pushreads-ai-api-keysreads-env-varschild-process-spawnreads-chromium-credsbase64-decodeeval-dynamicreads-system-info+2

→ Credential read (reads-ai-api-keys) paired with http-to-public-ip destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

16.7 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@actagent/acpx@2026.6.2

by nidaye0525

ACTAgent ACP runtime backend with plugin-owned session and transport management.

steals →npm tokenGitHub PATAI API keys

reads-env-varsreads-npmrcreads-github-tokensreads-ai-api-keysreads-homedirchild-process-spawn

weekly

—

/wk

h-score

patterns

size

398.2 KB

versions

AUTO-PUBLISHED/npm/2026-06-05

@start.dev/almostnode2 versions·0.3.0→0.3.1

by arielweinberger

Node.js in your browser. Just like that.

steals →AI API keysChromium logins→ sends tohttps://github.com/arielweinberger/almostnode.git

public-github-pushreads-ai-api-keysreads-env-varschild-process-spawnreads-chromium-credsbase64-decodeeval-dynamicfunction-constructor+2

→ Credential read (reads-ai-api-keys) paired with http-to-public-ip destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

15.6 MB

versions

AUTO-PUBLISHED/kitchen-sink · 8/npm/2026-06-05

ciphernest2 versions·0.4.0→0.8.4

by vmmuthu31

AI-aware security scanner for VS Code — code vulnerabilities, LLM risks, secrets, dependencies, MCP & agent security

steals →AWS keysAzure credsGitHub PATMCP configAI API keysChromium logins→ sends tohttps://github.com/vmmuthu31/CipherNest.git

public-github-pusheval-dynamicreads-env-varsclipboard-accessreads-github-tokenschild-process-spawnfs-recursive-readreads-aws-creds+7

→ Credential read (reads-github-tokens, reads-aws-creds, reads-ai-api-keys, reads-azure-creds) paired with webhook-bin destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

24.3 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@fleetagent/pi-coding-agent@0.0.8

by tiith

Coding agent CLI with read, bash, edit, write tools and session management

steals →GitLab PATAI API keys→ sends tohttps://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.91.1.tgz

clipboard-accesschild-process-spawnreads-env-varsreads-homedirreads-system-infofunction-constructorreads-gitlab-tokensreads-ai-api-keys+1

weekly

138

/wk

h-score

patterns

size

11.4 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@adminforth/completion-adapter-openai-responses@1.0.2

by vanbrosh

AdminForth completion adapter for the OpenAI Responses API.

steals →AI API keysSlack tokens→ sends toadminforth.dev · https://adminforth.dev/docs/tutorial/Adapters/completion…

public-github-pushreads-ai-api-keysreads-env-varsreads-slack-tokens

weekly

313

/wk

h-score

patterns

size

58.8 KB

versions

AUTO-PUBLISHED/kitchen-sink · 8/npm/2026-06-05

@yuechou/pi-ai4 versions·15.8.3-patched.1→15.8.3-patched.6

by yuechou

Unified LLM API with automatic model discovery and provider configuration

steals →AWS keysGCP credsGitHub PATGitLab PATAI API keys→ sends tohttps://omp.sh

public-github-pushreads-env-varschild-process-spawnreads-aws-credsreads-gcp-credsreads-github-tokensreads-gitlab-tokensreads-ai-api-keys+4

weekly

—

/wk

h-score

patterns

size

4.4 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@yuechou/pi-coding-agent4 versions·15.8.3-patched.1→15.8.3-patched.6

by yuechou

Coding agent CLI with read, bash, edit, write tools and session management

steals →GitHub PATAI API keysChromium logins→ sends tohttps://omp.sh

public-github-pushreads-env-varsreads-homedirreads-ai-api-keysreads-system-inforeads-chromium-credsreads-github-tokensbase64-decode+4

weekly

—

/wk

h-score

patterns

size

10.3 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

totem-llm2 versions·0.3.1→0.3.2

by fred_terzi

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

steals →npm tokenAI API keysTelegram→ sends tohttps://github.com/fred-terzi/totem-llm.git

public-github-pushreads-env-varsreads-homedirreads-telegram-datachild-process-spawnreads-npmrcreads-ai-api-keysreads-system-info+3

→ Credential read (reads-npmrc, reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

27.4 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@ngocsangairvds/vsaf@4.2.9

by ngocsangairvds

logging step

steals →AI API keys

reads-env-varschild-process-spawnreads-ai-api-keyspy-urllib-requestpy-sys-platform-branchpy-pip-install-runtimecurl-pipe-bashwebhook-bin+2

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

10.3 MB

versions

115

AUTO-PUBLISHED/npm/2026-06-04

@agentprojectcontext/apx5 versions·1.27.1→1.30.2

by tecnomanu

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

steals →AI API keysMCP config→ sends tohttp://localhost:7431

public-github-pushclipboard-accessreads-env-varsreads-ai-api-keysbase64-decodechild-process-spawnreads-homedirreads-mcp-config+4

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

10.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

openclaw-foundry-core@1.0.0

by xdemocle

The forge that forges itself — self-writing meta-extension for OpenClaw

steals →AI API keysChromium logins→ sends tohttps://api.anthropic.com

reads-ai-api-keysreads-chromium-credswebhook-bineval-dynamicfunction-constructorchild-process-spawnreads-env-vars

→ Credential read (reads-ai-api-keys) paired with webhook-bin destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

709.6 KB

versions

AUTO-PUBLISHED/npm/2026-06-04

@iola_adm/iola-cli21 versions·0.2.37→0.2.67

by iola_adm

CLI и AI-агент городского округа Йошкар-Ола.

steals →AI API keys→ sends tohttps://github.com/adm-iola/iola-cli#readme

public-github-pushreads-ai-api-keysreads-env-varsreads-homedirchild-process-spawneval-dynamicdest-via-hostname-var

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

2.8 MB

versions

179

AUTO-PUBLISHED/npm/2026-06-04

nodmix4 versions·2026.5.30→2026.5.35

by nodmix

Nodmix, the Supreme CEO Founder AI Agent. A large language model created and developed by Mehdi Faraj.

steals →AI API keys→ sends tohttps://nodmix.com

reads-env-varsreads-homedirchild-process-spawnpastebin-domainpublic-github-pusharchive-then-uploadreads-ai-api-keys

→ Credential read (reads-ai-api-keys) paired with pastebin-domain destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

100

patterns

size

42.1 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

cli-jaw@2.1.3

by bitkyc08

Personal AI assistant powered by Antigravity, AI-E, Claude, Claude E, Codex, Codex App, Cursor, Gemini, Grok, OpenCode, and Copilot — Web, Terminal, Telegram, and Discord interfaces with 107 built-in skills

steals →AI API keys1PasswordTelegram→ sends tohttps://github.com/lidge-jun/cli-jaw.git

reads-telegram-datapublic-github-pushchild-process-spawnreads-system-inforeads-env-varsreads-homedirreads-1passwordcurl-pipe-bash+4

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

25.3 MB

versions

206

AUTO-PUBLISHED/npm/2026-06-04

@almadar/llm@2.21.0

by javasop

Multi-provider LLM client with rate limiting, token tracking, structured outputs, and continuation handling

steals →AI API keys→ sends tohttps://github.com/almadar-io/almadar-llm.git

public-github-pushreads-ai-api-keysreads-env-varsdest-via-hostname-var

→ Credential read (reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

427.1 KB

versions

AUTO-PUBLISHED/pypi/2026-06-03

magenta-rt@2.0.2

by Google LLC

Real-time music generation models.

steals →GCP credsAI API keys→ sends tohttp://www.apache.org/licenses/LICENSE-2.0

py-pip-install-runtimereads-env-varsreads-homedireval-dynamicreads-gcp-credsreads-ai-api-keys

weekly

194

/wk

h-score

patterns

size

1.4 MB

versions

AUTO-PUBLISHED/vscode/2026-06-02

BMC-IZOT-UAP-Internship-TE-TEAM-3.static-sla-guardian-performance-impact-agent@65.0.0

by BMC-IZOT-UAP-Internship-TE-TEAM-3

Static COBOL analyzer: syntax check, dead code detection, feature extraction, SLA performance prediction, and Validate & Push gate.

steals →AI API keys→ sends tohttp://44.223.144.244:8000/appserver/integration

reads-ai-api-keyshttp-to-public-ip

→ Credential read (reads-ai-api-keys) paired with http-to-public-ip destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

5.4 MB

versions