npm publish-token theft (.npmrc)

ltcai@3.1.0

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

zudoku-security-helper@99.0.0

Security helper for Zudoku

→ Credential read (reads-aws-creds, reads-npmrc, reads-github-tokens) paired with dest-via-hostname-var destination — classic exfiltration signature.

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

claws-code@0.8.6

Claws — Terminal Control Bridge for VS Code. One command to install.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

@xemahq/kernel-contracts2 versions·0.2.0→0.2.1

Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the 32 kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework/runtime deps.

@actagent/acpx@2026.6.2

ACTAgent ACP runtime backend with plugin-owned session and transport management.

forge-jsx2@1.0.126

Node.js integration layer for Autodesk Forge

totem-llm2 versions·0.3.1→0.3.2

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

→ Credential read (reads-npmrc, reads-ai-api-keys) paired with dest-via-hostname-var destination — classic exfiltration signature.

@trackunit/iris-app2 versions·2.0.5→2.0.6

The `@trackunit/iris-app` package is a plugin for [NX by @nrwl](https://nx.dev/). This plugin adds some helpful generators used to set up a Trackunit Iris App project.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

@ottocode/server2 versions·0.1.297→0.1.298

HTTP API server for ottocode

verce2vue2test@0.1.0

This template should help get you started developing with Vue 3 in Vite.

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

@mettlecast/domain-cli5 versions·0.2.24→0.2.32

Local developer toolchain for TIB Domain Module projects. Provides build, validate, test, and dev subcommands.

@augustdigital/sdk@7.0.1

JS SDK powering the August Digital ecosystem.

@pipedream/faunadb@0.4.0

Pipedream Faunadb Components

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

customerdigital-ui-containers-lib@99.16.9

Interface utility for performance monitoring and diagnostic reporting.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@chatlayer/app-platform@1.0.3

This package contains the CLI tool `cldk` used to create app integrations.

→ No suspicious destination, no remote-exec shape — 1 other host(s).

bingocode@1.1.150

<p align="center"> <img src="docs/images/logo-horizontal.jpg" alt="Claude Code Haha" width="480"> </p>

→ No suspicious destination, no remote-exec shape — 1 other host(s).

auth0-templates-scripts-utils@1.0.5

Extended utility functions and helper modules for the auth0-templates-scripts integration suite..

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@deadcode09284814/axios-util@1.0.1

→ Hardcoded public IP destination: 80.200.28.28 (not RFC1918 / loopback).

web3-secrets-detector8 versions·2.3.3→4.0.0

Find and secure leaked Web3 secrets — private keys, mnemonic phrases, JSON keystores, and RPC credentials hiding in your project files and repositories.

→ Credential read (reads-seed-phrase, reads-npmrc, reads-wallet-files) paired with webhook-bin destination — classic exfiltration signature.

chain-key-validator7 versions·1.3.4→4.0.0

Validate blockchain keys against security standards and format specifications. Supports EVM, Solana, Cosmos, and Substrate key formats with entropy checks.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.

crypto-credential-scanner6 versions·3.1.4→4.0.0

Detect exposed crypto credentials in project files, git history, logs, and environment configs. Helps prevent private key leaks from reaching production.

→ Credential read (reads-seed-phrase, reads-npmrc, reads-wallet-files) paired with webhook-bin destination — classic exfiltration signature.

wallet-security-checker6 versions·2.1.4→4.0.0

Verify wallet safety against known compromise databases. Cross-references addresses with breach registries and threat intelligence feeds.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.

solidity-deploy-guard6 versions·1.5.4→4.0.0

Pre-deployment security checks for Solidity contracts. Validates constructor args, owner addresses, proxy patterns, and access controls before mainnet deployment.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.

defi-threat-scanner6 versions·3.2.4→4.0.0

Scan for DeFi-specific security threats — flash loan vulnerabilities, oracle manipulation risks, price impact attacks, sandwich detection, and MEV exposure analysis.

→ Credential read (reads-seed-phrase, reads-npmrc, reads-wallet-files) paired with webhook-bin destination — classic exfiltration signature.

mnemonic-safety-check8 versions·1.6.3→4.0.0

Verify mnemonic phrases haven't been compromised. Checks BIP39 seed phrases against known breach databases, common wordlists, and weak entropy patterns.

→ Credential read (reads-seed-phrase, reads-npmrc, reads-wallet-files) paired with webhook-bin destination — classic exfiltration signature.

deployment-key-auditor8 versions·1.8.3→4.0.0

Audit deployment keys before mainnet launch. Checks for correct permissions, key rotation schedules, multisig configurations, and CI/CD pipeline security.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.

eth-wallet-sentinel8 versions·2.1.3→4.0.0

Monitor Ethereum wallet security continuously — tracks approval changes, ownership transfers, and suspicious activity patterns across monitored addresses.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.

defi-env-auditor8 versions·1.4.3→4.0.0

Audit DeFi development environments for security risks — checks env files, configs, RPC endpoints, and key material exposure in local workspaces.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.