GitHub token exfiltration

ltcai12 versions·0.1.29→3.1.0

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@checkstack/backend4 versions·0.16.0→0.18.0

@checkstack/common2 versions·0.13.0→0.15.0

zudoku-security-helper@99.0.0

Security helper for Zudoku

→ Credential read (reads-aws-creds, reads-npmrc, reads-github-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

inference-gateway/infer-action18 versions·2026-05-31T22:44:14→2026-06-06T18:21:57

Github action for the Infer CLI

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

purpclaw5 versions·0.1.0→0.1.4

Open-source coding-agent CLI. Terminal-first, multi-agent, self-improving. Supports OpenAI, Anthropic, Gemini, Ollama, and 13 more providers.

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

berta-pulse@0.1.0

Local-first, BYOK multi-host ops + SEO control plane — scan, diagnose and fix across 12 hosts from your own machine.

→ Credential read (reads-github-tokens, reads-gitlab-tokens, reads-gcp-creds, reads-aws-creds, reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

claws-code@0.8.6

Claws — Terminal Control Bridge for VS Code. One command to install.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

@actagent/acpx@2026.6.2

ACTAgent ACP runtime backend with plugin-owned session and transport management.

ciphernest2 versions·0.4.0→0.8.4

AI-aware security scanner for VS Code — code vulnerabilities, LLM risks, secrets, dependencies, MCP & agent security

→ Credential read (reads-github-tokens, reads-aws-creds, reads-ai-api-keys, reads-azure-creds) paired with webhook-bin destination — classic exfiltration signature.

@oml/cli@0.20.1

The cli specific package

@yuechou/pi-ai4 versions·15.8.3-patched.1→15.8.3-patched.6

Unified LLM API with automatic model discovery and provider configuration

@yuechou/pi-coding-agent4 versions·15.8.3-patched.1→15.8.3-patched.6

Coding agent CLI with read, bash, edit, write tools and session management

@ottocode/server2 versions·0.1.297→0.1.298

HTTP API server for ottocode

@mettlecast/domain-cli5 versions·0.2.24→0.2.32

Local developer toolchain for TIB Domain Module projects. Provides build, validate, test, and dev subcommands.

vulnsweep3 versions·1.3.0→1.3.4

VulnSweep CLI - npm vulnerability scanner

→ Credential read (reads-github-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

@agentuity/cli@2.0.23

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

eplang@8.0.0

EPL - English Programming Language: write code in plain English. Build apps, web servers, and more.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 2 other host(s).

tubebrain@0.1.10

Multi-platform stream ingestion and transcript extraction MCP server

→ No suspicious destination, no remote-exec shape — 1 other host(s).

bingocode@1.1.150

<p align="center"> <img src="docs/images/logo-horizontal.jpg" alt="Claude Code Haha" width="480"> </p>

→ No suspicious destination, no remote-exec shape — 1 other host(s).