SSH private key theft

purpclaw5 versions·0.1.0→0.1.4

Open-source coding-agent CLI. Terminal-first, multi-agent, self-improving. Supports OpenAI, Anthropic, Gemini, Ollama, and 13 more providers.

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

@le-space/rootfs@0.3.12

Shared rootfs contract parsing, reference profile assets, and build helpers.

@le-space/node@0.3.12

Node and GitHub Actions adapters for shared Aleph tooling.

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

@proof-computer/proof-cli-switchboard5 versions·0.2.4→0.2.8

Switchboard plugin for the PROOF command line interface.

customerdigital-ui-containers-lib@99.16.9

Interface utility for performance monitoring and diagnostic reporting.

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

bingocode@1.1.150

<p align="center"> <img src="docs/images/logo-horizontal.jpg" alt="Claude Code Haha" width="480"> </p>

→ No suspicious destination, no remote-exec shape — 1 other host(s).

@deadcode09284814/axios-util@1.0.1

→ Hardcoded public IP destination: 80.200.28.28 (not RFC1918 / loopback).

@remitee-money-transfer/rmt-base@99.99.100

Manager

→ Credential read (reads-ssh-keys) paired with webhook-bin destination — classic exfiltration signature.