Static pattern: reads-slack-tokens

purpclaw5 versions·0.1.0→0.1.4

Open-source coding-agent CLI. Terminal-first, multi-agent, self-improving. Supports OpenAI, Anthropic, Gemini, Ollama, and 13 more providers.

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

@adminforth/background-jobs@1.13.0

Background jobs plugin for AdminForth to run and manage long tasks from resources

@delorenj/pjangler2 versions·1.1.3→1.1.5

Project subsystem bootstrapper CLI

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

@adminforth/dashboard@1.11.2

Dashboard plugin for AdminForth

@adminforth/completion-adapter-openai-responses@1.0.2

AdminForth completion adapter for the OpenAI Responses API.

@adminforth/agent@1.49.3

AI agent plugin for AdminForth with tool-based workflows and persistent chat sessions

@kodelyth/slack@2026.6.10

Klaw Slack channel plugin

@augustdigital/sdk@7.0.1

JS SDK powering the August Digital ecosystem.