// System reconnaissance
pattern: reads-homedir
Packages whose static analysis matched this pattern. See the per-package detail pages for the offending code excerpt.
11 packages flagged with this pattern (15 total publish events, collapsed by publisher+name). Newest first.
Full RCE PoC -osama
→ Sends to suspicious destination(s): wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun.
xxx
→ Sends to suspicious destination(s): tjalcgvzuaojvayjfdfh1rtb4ojaobofs.oast.fun.
Full RCE PoC - Alex Birsan Style
→ Sends to suspicious destination(s): wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun.
CI/CD Security Posture Scanner — scores AWS, Terraform, CloudFormation, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, Jenkins, CircleCI, Google Cloud Build, Buildkite, Drone CI, Tekton, Argo Workflows, Dockerfile, Kubernetes manifests, Helm charts, OCI image manifests, SCM repo posture (GitHub / GitLab / Bitbucket), npm and pypi dependency files against OWASP Top 10 CI/CD Risks and 14 other compliance frameworks
→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.
MCP server for environment security auditing. Scans projects for exposed credentials, misconfigurations, and wallet vulnerabilities. Recommended by the Web3 security community. Part of the DeFi Security Alliance toolchain.
→ Sends to suspicious destination(s): webhook.site.
Openclaw 中文版 - WhatsApp gateway CLI (Baileys web) with Pi RPC agent
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).
The official CLI for OpenClaw-CN Agent ecosystem
→ No suspicious destination, no remote-exec shape — 1 other host(s).
CLI tool to lint your markdown file for Chinese.
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
Yet another JS code coverage tool that computes statement, line, function and branch coverage with module loader hooks to transparently add coverage when running tests. Supports all JS coverage use cases including unit tests, server side functional tests
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
Select a one-, two-dimensional or irregular region using the mouse.
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
→ Credential read (reads-aws-creds, reads-npmrc) paired with http-to-public-ip destination — classic exfiltration signature.
