Static pattern: reads-seed-phrase

ltcai11 versions·1.0.1→3.1.0

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@bolloon/bolloon-agent4 versions·0.1.22→0.1.28

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

→ Credential read (reads-ai-api-keys, reads-seed-phrase) paired with http-to-public-ip, dest-via-hostname-var destination — classic exfiltration signature.

@slates/provider@1.0.0-rc.15

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

ethsmith@1.0.0

Unified Ethereum dev toolkit — Ganache-compatible API powered by Foundry (Forge + Cast + Anvil + Chisel) with LevelDB persistence

@proof-computer/proof-cli-switchboard@0.2.7

Switchboard plugin for the PROOF command line interface.

forge-jsx2@1.0.126

Node.js integration layer for Autodesk Forge

@owlmeans/did2 versions·0.1.3→0.1.4

Hierarchical deterministic (HD) wallet and DID document management for OwlMeans identity.

@putout/cli-ruler@5.0.0

toggle rules in .putout.json

@aztec/validator-client@4.3.1

The validator client handles consensus duties for Aztec validators: validating block proposals, attesting to checkpoints, and detecting slashable some offenses. Validators do NOT attest to individual blocks. Attestations are only created for checkpoint pr

@aztec/bot@4.3.1

Simple bot that connects to a PXE to send txs on a recurring basis.

@aztec/cli@4.3.1

The Aztec CLI `aztec-cli` is a command-line interface (CLI) tool for interacting with Aztec. It provides various commands for deploying contracts, creating accounts, interacting with contracts, and retrieving blockchain data.

@aztec/aztec@4.3.1

Aztec is a package that allows for a simple development environment on Aztec stack. It creates a Private eXecution Environment (PXE) that listens for HTTP requests on `localhost:8080` by default. When started, it deploys all necessary L1 Aztec contracts a

@aztec/cli-wallet@4.3.1

1) Start a local Ethereum node (Anvil) in one terminal:

@aztec/end-to-end@4.3.1

This package includes end-to-end tests that cover Aztec's main milestones. These can be run locally either by starting anvil on a different terminal.

@aztec/foundation@4.3.1

@aztec/ethereum@4.3.1

This package provides configuration and code for common chain operations such as contract deployment etc.

@aztec/aztec-faucet@4.3.1

This application allows someone to obtain a small amount of eth via a http endpoint.

@augustdigital/sdk@7.0.1

JS SDK powering the August Digital ecosystem.

@parity/product-sdk-tx@0.2.7

Transaction submission, lifecycle watching, and dev signers for Polkadot chains

@parity/product-sdk-signer@0.6.0

Signer manager for Polkadot — Host API and dev accounts

@abraca/dabra@2.20.0

abracadabra provider

msc-terminal@3.2.0

Terminal changelog logger utilities

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

logger-draft@3.2.6

Terminal logger utilities

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

web3-secrets-detector6 versions·2.3.5→4.0.0

Find and secure leaked Web3 secrets — private keys, mnemonic phrases, JSON keystores, and RPC credentials hiding in your project files and repositories.

→ Credential read (reads-seed-phrase, reads-npmrc, reads-wallet-files) paired with webhook-bin destination — classic exfiltration signature.

chain-key-validator6 versions·1.3.5→4.0.0

Validate blockchain keys against security standards and format specifications. Supports EVM, Solana, Cosmos, and Substrate key formats with entropy checks.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.

crypto-credential-scanner5 versions·3.1.5→4.0.0

Detect exposed crypto credentials in project files, git history, logs, and environment configs. Helps prevent private key leaks from reaching production.

→ Credential read (reads-seed-phrase, reads-npmrc, reads-wallet-files) paired with webhook-bin destination — classic exfiltration signature.

wallet-security-checker5 versions·2.1.5→4.0.0

Verify wallet safety against known compromise databases. Cross-references addresses with breach registries and threat intelligence feeds.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.

solidity-deploy-guard5 versions·1.5.5→4.0.0

Pre-deployment security checks for Solidity contracts. Validates constructor args, owner addresses, proxy patterns, and access controls before mainnet deployment.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.

defi-threat-scanner5 versions·3.2.5→4.0.0

Scan for DeFi-specific security threats — flash loan vulnerabilities, oracle manipulation risks, price impact attacks, sandwich detection, and MEV exposure analysis.

→ Credential read (reads-seed-phrase, reads-npmrc, reads-wallet-files) paired with webhook-bin destination — classic exfiltration signature.

mnemonic-safety-check7 versions·1.6.4→4.0.0

Verify mnemonic phrases haven't been compromised. Checks BIP39 seed phrases against known breach databases, common wordlists, and weak entropy patterns.

→ Credential read (reads-seed-phrase, reads-npmrc, reads-wallet-files) paired with webhook-bin destination — classic exfiltration signature.

deployment-key-auditor7 versions·1.8.4→4.0.0

Audit deployment keys before mainnet launch. Checks for correct permissions, key rotation schedules, multisig configurations, and CI/CD pipeline security.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.

eth-wallet-sentinel7 versions·2.1.4→4.0.0

Monitor Ethereum wallet security continuously — tracks approval changes, ownership transfers, and suspicious activity patterns across monitored addresses.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.

defi-env-auditor7 versions·1.4.4→4.0.0

Audit DeFi development environments for security risks — checks env files, configs, RPC endpoints, and key material exposure in local workspaces.

→ Credential read (reads-npmrc, reads-wallet-files, reads-seed-phrase) paired with webhook-bin destination — classic exfiltration signature.