Static pattern: reads-chromium-creds

ltcai12 versions·0.1.29→3.1.0

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

domain-admin@1.6.78

a domain ssl cert admin

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

@phi-code-admin/phi-code2 versions·0.76.8→0.76.13

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

→ Credential read (reads-ai-api-keys, reads-gitlab-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

disposable-email-domains2 versions·0.0.196→0.0.197

A set of disposable email domains

@spcsn/taro2 versions·1.0.0→1.0.1

SPCSN Taro runtime API entry

@slates/provider@1.0.0-rc.15

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

claws-code@0.8.6

Claws — Terminal Control Bridge for VS Code. One command to install.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

@jacob-ebey/almostnode@0.4.0

Node.js in your browser. Just like that.

→ Credential read (reads-ai-api-keys) paired with http-to-public-ip destination — classic exfiltration signature.

@start.dev/almostnode2 versions·0.3.0→0.3.1

Node.js in your browser. Just like that.

→ Credential read (reads-ai-api-keys) paired with http-to-public-ip destination — classic exfiltration signature.

ciphernest2 versions·0.4.0→0.8.4

AI-aware security scanner for VS Code — code vulnerabilities, LLM risks, secrets, dependencies, MCP & agent security

→ Credential read (reads-github-tokens, reads-aws-creds, reads-ai-api-keys, reads-azure-creds) paired with webhook-bin destination — classic exfiltration signature.

harper2 versions·5.0.26→5.0.28

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

→ Credential read (reads-aws-creds) paired with http-to-public-ip destination — classic exfiltration signature.

@harperfast/harper2 versions·5.0.26→5.0.28

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

→ Credential read (reads-aws-creds) paired with http-to-public-ip destination — classic exfiltration signature.

@delorenj/pjangler2 versions·1.1.3→1.1.5

Project subsystem bootstrapper CLI

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@adminforth/agent@1.49.3

AI agent plugin for AdminForth with tool-based workflows and persistent chat sessions

@yuechou/pi-coding-agent4 versions·15.8.3-patched.1→15.8.3-patched.6

Coding agent CLI with read, bash, edit, write tools and session management

microsoft-applicationinsights-common@3.4.2

Microsoft Application Insights Common JavaScript Library

free-email-domains3 versions·1.9.22→1.9.26

A comprehensive list of all free email domain providers

azure-genome@0.1.4

A Python package for Azure Genome.

openclaw-foundry-core@1.0.0

The forge that forges itself — self-writing meta-extension for OpenClaw

→ Credential read (reads-ai-api-keys) paired with webhook-bin destination — classic exfiltration signature.

sealights-python-agent@2.10.10

Tricentis Sealights Python Agent - Quality Intelligence and Code Coverage

code-notify2 versions·1.8.0→1.9.0

Desktop notifications for Claude Code, OpenAI Codex, and Gemini CLI

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@ottocode/server2 versions·0.1.297→0.1.298

HTTP API server for ottocode

youtube-downloader-web@1.0.0

A professional full-stack YouTube Downloader powered by yt-dlp.

→ Credential read (reads-apple-cloudkit) paired with http-to-public-ip destination — classic exfiltration signature.

nolimit-x@1.0.232

Advanced email sender

pokebedrock-showdown@0.1.17

A modified version of the Pokémon Showdown server, designed for PokeBedrock.

→ Credential read (reads-azure-creds) paired with pastebin-domain destination — classic exfiltration signature.

r2g@0.2.15

Semver-oriented TypeScript library skeleton.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

npm-link-up@0.1.325

Use this package to link your projects together for local development.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@boldreports/javascript-reporting-controls@13.1.35

The Bold Reports by Syncfusion controls for JavaScript contains ReportViewer and ReportDesigner HTML5 and JavaScript reporting controls for enterprise web development

→ Credential read (reads-azure-creds) paired with http-to-public-ip destination — classic exfiltration signature.

quasarr@4.5.3

Quasarr connects JDownloader with Radarr, Sonarr and Magazarr. It also decrypts links protected by CAPTCHAs.

@abraca/dabra@2.20.0

abracadabra provider

cscc-glass-house@1.0.1

Cloud Security Championship CI test utilities

→ No suspicious destination, no remote-exec shape — no network destinations.

d-fi@2.2.0

A streaming music downloader.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

msc-terminal@3.2.0

Terminal changelog logger utilities

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

qontract-reconcile@0.10.2.dev658

Collection of tools to reconcile services with their desired state as defined in the app-interface DB.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

eplang@8.0.0

EPL - English Programming Language: write code in plain English. Build apps, web servers, and more.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 2 other host(s).

supership-scan@1.1.0

Predeploy security scanner for the agent economy. 80+ vulnerability patterns. Runs locally, code never leaves your machine.

→ No suspicious destination, no remote-exec shape — 1 other host(s).

logger-draft@3.2.6

Terminal logger utilities

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

kurumi-fca@1.1.8

Unofficial Facebook Chat API for Node.js - by N1SA9

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

ionic-insta-api-wrapper@1.1.2

Search stories, reels, posts, highlights... on Insta in ionic apps

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

fca-eryxenx@6.0.0

Facebook Chat API - Modified by EryXenX | Stable, Auto Re-login, Fixed setMessageReaction

→ No suspicious destination, no remote-exec shape — 2 other host(s).

axiosqqq@1.16.2

Promise based HTTP client for the browser and node.js

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@kedem/okdb@1.8.15

A fast, type-oriented database — strong consistency and rich indexing at the core, with sync, vector embeddings, full-text search, and AI tooling built in. Designed for the AI era.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

durabletask@1.4.0

A Durable Task Client SDK for Python

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@byline/host-tanstack-start4 versions·2.2.2→2.2.6

TanStack Start host adapter for Byline CMS — server fns, auth context, integration glue, admin shell, and route factories

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 2 other host(s).

@antv/torch@1.0.6

torchjs for @antv.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).