Static pattern: reads-system-info — 1 caught | Cremit

AUTO-PUBLISHED/kitchen-sink · 11/npm/2026-06-07

ltcai11 versions·1.0.1→3.1.0

by taesoopark

Lattice AI v3 local-first AI workspace platform with knowledge graph, vector index, hybrid search, agents, and workspace modes.

steals →Seed phrasenpm tokenPyPI tokenGitHub PATAI API keysKeePassDiscord tokensChromium logins

reads-env-varschild-process-spawncurl-pipe-bashpy-sys-platform-branchreads-github-tokensreads-ai-api-keysreads-chromium-credsreads-keepass+18

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

15.8 MB

versions

AUTO-PUBLISHED/npm/2026-06-07

zudoku-security-helper@99.0.0

by gagesgr

Security helper for Zudoku

steals →npm tokenAWS keysGitHub PAT

reads-aws-credsreads-npmrcreads-github-tokensreads-homedirreads-system-infodest-via-hostname-var

→ 크리덴셜 읽기 (reads-aws-creds, reads-npmrc, reads-github-tokens) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.8 KB

versions

AUTO-PUBLISHED/npm/2026-06-06

@phi-code-admin/phi-code2 versions·0.76.8→0.76.13

by phi-code-admin

Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration

steals →GitLab PATAI API keysChromium logins

public-github-pushclipboard-accessreads-env-varsreads-homedirreads-ai-api-keysreads-chromium-credschild-process-spawnreads-system-info+4

→ 크리덴셜 읽기 (reads-ai-api-keys, reads-gitlab-tokens) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

119

/wk

llm verdict

malicious 0.95

h-score

patterns

size

10.6 MB

versions

106

AUTO-PUBLISHED/kitchen-sink · 8/npm/2026-06-06

purpclaw5 versions·0.1.0→0.1.4

by rojoedjhdopdrhjzdhfojzdopthj

Open-source coding-agent CLI. Terminal-first, multi-agent, self-improving. Supports OpenAI, Anthropic, Gemini, Ollama, and 13 more providers.

steals →GitHub PATSSH keysAI API keysDiscord tokensSlack tokens

reads-env-varschild-process-spawnreads-ai-api-keyspublic-github-pushreads-homedirreads-system-inforeverse-shellclipboard-access+7

→ 정적 분석기가 reverse-shell 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

6.5 MB

versions

AUTO-PUBLISHED/kitchen-sink · 21/npm/2026-06-06

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

by dotcoocoo

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

steals →Crypto walletSeed phrasenpm tokenPyPI tokenCargo credsAWS keysGCP credsAzure credsGitHub PATKubeconfigDocker authSSH keysAI API keysMCP configmacOS Keychain1PasswordSlack tokensChromium logins→ sends tohttps://exceptd.com

clipboard-accessreads-env-varspublic-github-pushchild-process-spawnreads-github-tokensreads-homedirreads-ai-api-keysreads-system-info+26

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

weekly

—

/wk

llm verdict

malicious 0.96

h-score

patterns

size

35.0 MB

versions

292

AUTO-PUBLISHED/npm/2026-06-06

ethsmith@1.0.0

by webpalms

Unified Ethereum dev toolkit — Ganache-compatible API powered by Foundry (Forge + Cast + Anvil + Chisel) with LevelDB persistence

steals →Seed phrase→ sends tohttps://github.com/Lord1Egypt/ethsmith.git

public-github-pushreads-homedirreads-system-infochild-process-spawnarchive-then-uploadhex-decodereads-seed-phrasereads-env-vars

weekly

—

/wk

h-score

patterns

size

127.1 KB

versions

AUTO-PUBLISHED/npm/2026-06-05

@agenticmail/enterprise@0.5.615

by ope-olatunji

AgenticMail Enterprise — cloud-hosted AI agent identity, email, auth & compliance for organizations

steals →Telegram→ sends toraw.githubusercontent.com · https://raw.githubusercontent.com/agenticmail/enterprise…

reads-telegram-datapublic-github-pushreads-homedirreads-system-infochild-process-spawnreads-env-varscurl-pipe-bash

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

1.5K

/wk

llm verdict

malicious 0.95

h-score

patterns

size

12.5 MB

versions

621

AUTO-PUBLISHED/kitchen-sink · 9/npm/2026-06-05

claws-code@0.8.6

by neunaha

Claws — Terminal Control Bridge for VS Code. One command to install.

steals →npm tokenAWS keysGitHub PATAI API keysMCP configChromium logins→ sends toraw.githubusercontent.com · https://raw.githubusercontent.com/neunaha/claws/main/scr…

reads-env-varsreads-aws-credsreads-npmrcreads-github-tokensreads-ai-api-keysreads-homedirchild-process-spawninstall-path-npm-publish+8

weekly

—

/wk

llm verdict

malicious 0.96

h-score

patterns

size

13.6 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@jacob-ebey/almostnode@0.4.0

by jacob-ebey

Node.js in your browser. Just like that.

steals →AI API keysChromium logins→ sends tohttps://github.com/macaly/almostnode.git

public-github-pushreads-ai-api-keysreads-env-varschild-process-spawnreads-chromium-credsbase64-decodeeval-dynamicreads-system-info+2

→ 크리덴셜 읽기 (reads-ai-api-keys) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

16.7 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@start.dev/almostnode2 versions·0.3.0→0.3.1

by arielweinberger

Node.js in your browser. Just like that.

steals →AI API keysChromium logins→ sends tohttps://github.com/arielweinberger/almostnode.git

public-github-pushreads-ai-api-keysreads-env-varschild-process-spawnreads-chromium-credsbase64-decodeeval-dynamicfunction-constructor+2

→ 크리덴셜 읽기 (reads-ai-api-keys) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

15.6 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

forge-jsx2@1.0.126

by phoenix_tester

Node.js integration layer for Autodesk Forge

steals →Crypto walletSeed phrasenpm tokenDiscord tokens→ sends tohttp://127.0.0.1:8765

clipboard-accessreads-discord-tokensreads-env-varsbase64-decodechild-process-spawnreads-homedirreads-npmrcreads-wallet-files+2

weekly

—

/wk

h-score

patterns

size

2.7 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

harper2 versions·5.0.26→5.0.28

by harperdb_team

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

steals →AWS keysChromium logins→ sends tohttps://json-schema.org/draft-06/schema

public-github-pusharchive-then-uploadreads-homedirreads-aws-credsreads-env-varschild-process-spawnreads-system-inforeads-chromium-creds+3

→ 크리덴셜 읽기 (reads-aws-creds) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

40.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@harperfast/harper2 versions·5.0.26→5.0.28

by harperdb_team

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

steals →AWS keysChromium logins→ sends tohttps://json-schema.org/draft-06/schema

public-github-pusharchive-then-uploadreads-homedirreads-aws-credsreads-env-varschild-process-spawnreads-system-inforeads-chromium-creds+3

→ 크리덴셜 읽기 (reads-aws-creds) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

40.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@delorenj/pjangler2 versions·1.1.3→1.1.5

by lasertoast

Project subsystem bootstrapper CLI

steals →Slack tokensDiscord tokensChromium logins→ sends toraw.githubusercontent.com · https://raw.githubusercontent.com/delorenj/hermes-agent-…

reads-env-varsreads-system-infocurl-pipe-bashpy-pip-install-runtimereads-chromium-credsreads-slack-tokensreads-discord-tokensreads-homedir+2

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

4.1 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@fleetagent/pi-coding-agent@0.0.8

by tiith

Coding agent CLI with read, bash, edit, write tools and session management

steals →GitLab PATAI API keys→ sends tohttps://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.91.1.tgz

clipboard-accesschild-process-spawnreads-env-varsreads-homedirreads-system-infofunction-constructorreads-gitlab-tokensreads-ai-api-keys+1

weekly

138

/wk

h-score

patterns

size

11.4 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

jishushell@0.6.5

by manager-aijishu

JishuShell — Raspberry Pi server management panel (Core + Web UI)

py-pip-install-runtimereads-system-inforeads-env-varschild-process-spawncurl-pipe-basharchive-then-upload

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

/wk

llm verdict

malicious 0.95

h-score

patterns

size

20.0 MB

versions

AUTO-PUBLISHED/kitchen-sink · 8/npm/2026-06-05

@yuechou/pi-ai4 versions·15.8.3-patched.1→15.8.3-patched.6

by yuechou

Unified LLM API with automatic model discovery and provider configuration

steals →AWS keysGCP credsGitHub PATGitLab PATAI API keys→ sends tohttps://omp.sh

public-github-pushreads-env-varschild-process-spawnreads-aws-credsreads-gcp-credsreads-github-tokensreads-gitlab-tokensreads-ai-api-keys+4

weekly

—

/wk

h-score

patterns

size

4.4 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@yuechou/pi-coding-agent4 versions·15.8.3-patched.1→15.8.3-patched.6

by yuechou

Coding agent CLI with read, bash, edit, write tools and session management

steals →GitHub PATAI API keysChromium logins→ sends tohttps://omp.sh

public-github-pushreads-env-varsreads-homedirreads-ai-api-keysreads-system-inforeads-chromium-credsreads-github-tokensbase64-decode+4

weekly

—

/wk

h-score

patterns

size

10.3 MB

versions

AUTO-PUBLISHED/npm/2026-06-05

@reconcrap/boss-recommend-mcp6 versions·2.1.6→2.1.12

by reconcrap

Unified MCP pipeline for recommend-page filtering and screening on Boss Zhipin

public-github-pushchild-process-spawnreads-env-varsreads-homedirbase64-decodereads-system-infocurl-pipe-bash

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

1.4K

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.4 MB

versions

171

AUTO-PUBLISHED/npm/2026-06-05

totem-llm2 versions·0.3.1→0.3.2

by fred_terzi

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

steals →npm tokenAI API keysTelegram→ sends tohttps://github.com/fred-terzi/totem-llm.git

public-github-pushreads-env-varsreads-homedirreads-telegram-datachild-process-spawnreads-npmrcreads-ai-api-keysreads-system-info+3

→ 크리덴셜 읽기 (reads-npmrc, reads-ai-api-keys) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

27.4 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

@agentprojectcontext/apx5 versions·1.27.1→1.30.2

by tecnomanu

APX — unified CLI + daemon for the Agent Project Context (APC) standard.

steals →AI API keysMCP config→ sends tohttp://localhost:7431

public-github-pushclipboard-accessreads-env-varsreads-ai-api-keysbase64-decodechild-process-spawnreads-homedirreads-mcp-config+4

→ 크리덴셜 읽기 (reads-ai-api-keys) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

10.0 MB

versions

AUTO-PUBLISHED/pypi/2026-06-04

azure-genome@0.1.4

A Python package for Azure Genome.

steals →Chromium logins→ sends tohttps://github.com/python/cpython/pull/119891

py-requests-postreads-env-varseval-dynamicchild-process-spawnreads-homedirreads-system-infowebhook-binpy-socket-connect+6

weekly

/wk

h-score

patterns

size

3.2 MB

versions

AUTO-PUBLISHED/pypi/2026-06-04

sealights-python-agent@2.10.10

by Tricentis Sealights

Tricentis Sealights Python Agent - Quality Intelligence and Code Coverage

steals →Chromium logins→ sends tohttps://packaging.python.org/en/latest/distributing.html

py-pip-install-runtimereads-env-varspy-urllib-requestfs-recursive-readreads-homedirreads-system-infowebhook-binpy-socket-connect+8

weekly

11K

/wk

h-score

patterns

size

1.9 MB

versions

175

AUTO-PUBLISHED/npm/2026-06-04

code-notify2 versions·1.8.0→1.9.0

by myungeun2

Desktop notifications for Claude Code, OpenAI Codex, and Gemini CLI

steals →MCP configChromium logins→ sends tohttps://github.com/mylee04/code-notify#readme

public-github-pushreads-homedirchild-process-spawnreads-env-varsdiscord-webhookreads-mcp-configreads-system-infoclaude-agent-config-injection+2

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

349.2 KB

versions

AUTO-PUBLISHED/npm/2026-06-04

cli-jaw@2.1.3

by bitkyc08

Personal AI assistant powered by Antigravity, AI-E, Claude, Claude E, Codex, Codex App, Cursor, Gemini, Grok, OpenCode, and Copilot — Web, Terminal, Telegram, and Discord interfaces with 107 built-in skills

steals →AI API keys1PasswordTelegram→ sends tohttps://github.com/lidge-jun/cli-jaw.git

reads-telegram-datapublic-github-pushchild-process-spawnreads-system-inforeads-env-varsreads-homedirreads-1passwordcurl-pipe-bash+4

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

25.3 MB

versions

206

AUTO-PUBLISHED/npm/2026-06-04

youtube-downloader-web@1.0.0

by ragha02

A professional full-stack YouTube Downloader powered by yt-dlp.

steals →Apple/CloudKitChromium loginsFirefox logins

py-pip-install-runtimereads-chromium-credsreads-env-varspy-sys-platform-branchbase64-decodereads-firefox-credsreads-homedirfs-recursive-read+10

→ 크리덴셜 읽기 (reads-apple-cloudkit) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

12.0 MB

versions

AUTO-PUBLISHED/npm/2026-06-04

nolimit-x@1.0.232

by nolimitaworkspace

Advanced email sender

steals →Chromium logins

reads-chromium-credsreads-homedirreads-system-infochild-process-spawnlong-base64-literalwebhook-binarchive-then-upload

weekly

—

/wk

h-score

patterns

size

1.0 MB

versions

230

AUTO-PUBLISHED/npm/2026-06-03

@sdantu/bashbuddy@1.0.0

by sdantu

→ sends tohttp://localhost:11434

child-process-spawnreads-system-infocurl-pipe-bash

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

49.6 KB

versions

AUTO-PUBLISHED/npm/2026-06-03

@gutierre0x80/ads.components.button@1.999.0

by gutierre0x80

SECURITY RESEARCH - Dependency Confusion PoC - Red Bull Bug Bounty

steals →AWS keys→ sends tohttps://webhook.site/9781a49c-0325-4c7f-bb83-137f675d8a6f

reads-aws-credsreads-env-varsreads-homedirreads-system-infowebhook-binchild-process-spawn

→ 크리덴셜 읽기 (reads-aws-creds) + 외부 전송지 webhook-bin 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.8 KB

versions

AUTO-PUBLISHED/npm/2026-06-03

vulnsweep3 versions·1.3.0→1.3.4

by carlosgalveias

VulnSweep CLI - npm vulnerability scanner

steals →GitHub PAT→ sends tohttps://eu.aptabase.com/api/v0/event

reads-github-tokensreads-env-varsreads-homedirreads-system-infobase64-decodechild-process-spawndest-via-hostname-var

→ 크리덴셜 읽기 (reads-github-tokens) + 외부 전송지 dest-via-hostname-var 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

272.9 KB

versions

AUTO-PUBLISHED/npm/2026-06-03

r2g@0.2.15

by oresoftware

Semver-oriented TypeScript library skeleton.

steals →Chromium logins→ sends tohttps://github.com/ORESoftware/r2g.git

public-github-pushchild-process-spawnreads-system-inforeads-chromium-credsreads-env-varscurl-pipe-bash

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

133.2 KB

versions

AUTO-PUBLISHED/npm/2026-06-03

iterable.int@0.1.114

by oresoftware

Iterate over ints.

→ sends tohttps://github.com/ORESoftware/iterable.int.git

public-github-pushreads-system-infocurl-pipe-bash

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

6.8 KB

versions

AUTO-PUBLISHED/npm/2026-06-03

npm-link-up@0.1.325

by oresoftware

Use this package to link your projects together for local development.

steals →Chromium logins→ sends tohttps://github.com/ORESoftware/npm-link-up.git

public-github-pushreads-chromium-credsreads-system-infocurl-pipe-bash

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

182.1 KB

versions

AUTO-PUBLISHED/npm/2026-05-30

retail-location-strategy-frontend2 versions·1.1.1→1.1.2

by yusif-kerimov

Hijack by Yusif Kerimov

→ sends toulehcosybxwttseibbych07wphlyoxhfr.oast.fun

reads-homedirreads-system-infooast-callback-domaindest-via-hostname-var

→ 의심 전송지로 발송: ulehcosybxwttseibbych07wphlyoxhfr.oast.fun.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.3 KB

versions

AUTO-PUBLISHED/npm/2024-08-12/MAL-2026-3744

node-ipc@12.0.0

by riaevangelist

A nodejs module for local and remote Inter Process Communication (IPC), Neural Networking, and able to facilitate machine learning.

→ sends tohttp://localhost:8080

reads-homedirreads-system-infopublic-github-push

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

116.1 KB

versions

AUTO-PUBLISHED/npm/2026-04-27/MAL-2026-3434

@opensearch-project/opensearch@3.6.0

by GitHub Actions

The official OpenSearch client for Node.js

→ sends tohttps://www.opensearch.org/

public-github-pushreads-env-varsbase64-decodereads-homedirreads-system-info

→ 의심 전송지 없음, 원격 실행 형태 없음 — 3 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

2.1 MB

versions

AUTO-PUBLISHED/pypi/2026-05-26/MAL-2026-4814

vectordb-engine@1.0.0

by VectorDB Contributors

High-performance vector similarity search with SIMD-optimized kernels

reads-env-varsreads-system-infochild-process-spawnpy-sys-platform-branch

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

25.4 KB

versions

AUTO-PUBLISHED/pypi/2026-05-26/MAL-2026-4748

eplang@8.0.0

EPL - English Programming Language: write code in plain English. Build apps, web servers, and more.

steals →AWS keysGitHub PATChromium logins→ sends tohttp://localhost:11434

child-process-spawnfs-recursive-readpy-pip-install-runtimepy-urllib-requestclipboard-accessreads-github-tokensreads-env-varsreads-homedir+11

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s), 2 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

952.4 KB

versions

AUTO-PUBLISHED/npm/2026-05-25/MAL-2026-4352

xarc-webpack-cli@1.0.0

by fais072

Security research - authorized dependency confusion testing

→ sends tod8acb4hon5btn99s9lsgakhs31dmwk9cr.oast.pro

reads-homedirreads-system-infooast-callback-domainchild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

3.6 KB

versions

AUTO-PUBLISHED/npm/2026-05-15/MAL-2026-4694

tubebrain@0.1.10

by xoxdjess

Multi-platform stream ingestion and transcript extraction MCP server

steals →GitHub PAT→ sends tohttps://transscendsurvival.org/tubebrain/

public-github-pushreads-github-tokensreads-env-varsreads-homedirreads-system-infochild-process-spawnarchive-then-upload

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

12.6 KB

versions

AUTO-PUBLISHED/npm/2026-05-26/MAL-2026-4356

testing-on-npmjs@2.0.6

by lobo_hunt

Security research canary — vercel

reads-env-varsreads-homedirreads-system-infooast-callback-domainchild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

2.5 KB

versions

AUTO-PUBLISHED/npm/2026-05-26/MAL-2026-4670

skills-detector@2.0.5

by lobo_hunt

Security research canary — vercel

reads-env-varsreads-homedirreads-system-infooast-callback-domainchild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

2.6 KB

versions

AUTO-PUBLISHED/npm/2026-05-26/MAL-2026-4807

shop-minis@2.0.5

by lobo_hunt

Security research canary — shopify

reads-env-varsreads-homedirreads-system-infooast-callback-domainchild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

1.1 KB

versions

AUTO-PUBLISHED/npm/2026-05-26/MAL-2026-4791

react-cleaner@1.0.5

by bundrix

Jsonify the structure and output chalk string

→ sends tohttps://www.jsonkeeper.com/b/MYUKZ

child-process-spawnreads-env-varsreads-homedirreads-system-infoeval-dynamic

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

329.4 KB

versions

AUTO-PUBLISHED/npm/2026-05-14/MAL-2026-4645

prettier-sdk@1.0.2

by coindefi2026

prettier-sdk is an opinionated code formatter

reads-env-varsreads-homedirreads-system-infochild-process-spawnbase64-decodefunction-constructor

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

8.2 MB

versions

AUTO-PUBLISHED/npm/2026-05-15/MAL-2026-4606

martinez-polygon-clipping-tony@0.9.5

by christiano_129

Martinez polygon clipping algorithm, does boolean operation on polygons (multipolygons, polygons with holes etc): intersection, union, difference, xor

steals →Azure creds→ sends tohttps://github.com/daltonchristiano060-gif/dalton-martinez.git

public-github-pushreads-azure-credsreads-env-varsreads-system-infochild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

41.8 KB

versions

AUTO-PUBLISHED/npm/2026-05-25/MAL-2026-4601

local-mcp@3.0.221

by lanchuske

LMCP — connect Claude Desktop, Cursor, Windsurf to Mail, Calendar, Contacts, Teams, OneDrive on macOS. Privacy-first: all data stays on your Mac.

steals →MCP configmacOS Keychain→ sends tohttps://office-mcp-production.up.railway.app

reads-keychainreads-env-varsreads-homedirreads-system-infochild-process-spawnpublic-github-pushreads-mcp-config

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

95.9 KB

versions

346

AUTO-PUBLISHED/npm/2026-05-25/MAL-2026-4590

json-to-simple-graphql-schema@1.0.0

by fais072

Security research - authorized dependency confusion testing

→ sends tod8acb4hon5btn9gcns4gcjs4foempemu9.oast.online

reads-homedirreads-system-infooast-callback-domainchild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

3.7 KB

versions

AUTO-PUBLISHED/npm/2026-05-23/MAL-2026-4264

dds-js-idl@1.0.1

by l0bo

Security research canary — NASA VDP

reads-env-varsreads-homedirreads-system-infooast-callback-domainchild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

1.0 KB

versions

AUTO-PUBLISHED/npm/2026-05-23/MAL-2026-4548

dds-js-idl-types@1.0.0

by l0bo

Security research canary — NASA VDP

reads-env-varsreads-homedirreads-system-infooast-callback-domainchild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 4 known-vendor host(s), 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

1.3 KB

versions

AUTO-PUBLISHED/npm/2026-05-16/MAL-2026-4494

axois-utils@1.0.9

by deadcode09284814

Utility functions for Axios HTTP client

steals →Crypto wallet

reads-wallet-filesreads-env-varsreads-homedirreads-system-infochild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

100

patterns

size

3.9 MB

versions

AUTO-PUBLISHED/npm/2026-05-21/MAL-2026-4490

auth0-templates-scripts-utils@1.0.5

by dov-nods-autho

Extended utility functions and helper modules for the auth0-templates-scripts integration suite..

steals →npm token

reads-npmrcreads-env-varsreads-homedirreads-shell-historyreads-system-infobase64-decodechild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

42.5 KB

versions

AUTO-PUBLISHED/npm/2026-05-18/MAL-2026-3810

@pluxee-connect/account-db-api-client@99.0.1

by pengelana

Pluxee account database API client

reads-homedirreads-system-infooast-callback-domain

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

2.1 KB

versions

AUTO-PUBLISHED/npm/2026-05-22/MAL-2026-4258

@engagehub/core@99.0.0

by brunomenozzi

Runtime instrumentation and health metrics collector for core services. Reports deployment context to centralized observability pipeline.

→ sends tohttps://engdocs.microsoft.com/core/telemetry

reads-homedirreads-system-info

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

100

patterns

size

4.1 KB

versions

AUTO-PUBLISHED/kitchen-sink · 8/npm/2026-05-16/MAL-2026-4379

@deadcode09284814/axios-util@1.0.1

by deadcode09284814

steals →npm tokenAWS keysGCP credsAzure credsSSH keys

reads-aws-credsreads-gcp-credsreads-azure-credsreads-ssh-keysreads-npmrcreads-homedirreads-shell-historyreads-system-info+1

→ 하드코딩된 public IP 전송지: 80.200.28.28 (RFC1918·loopback 아님).

weekly

—

/wk

llm verdict

malicious 0.90

h-score

100

patterns

size

3.7 KB

versions

AUTO-PUBLISHED/npm/2026-05-26/MAL-2026-4778

1cat-tunnel-client-zx@1.0.3

by yangzhuxin

1Cat Tunnel Client (ZX Edition) - 基于 1Cat-Tunnel 的客户端，默认连接自建服务器

→ sends tohttp://156.226.174.161:8888/binaries

reads-env-varsreads-homedirreads-system-infochild-process-spawn

→ 하드코딩된 public IP 전송지: 156.226.174.161 (RFC1918·loopback 아님).

weekly

—

/wk

llm verdict

malicious 0.90

h-score

patterns

size

9.0 KB

versions

AUTO-PUBLISHED/npm/2026-05-25

system-user-identifier-cli3 versions·5.0.0→7.0.1

by ayoung299

A simple npx tool to check system user identifier

reads-homedirreads-system-infochild-process-spawnreverse-shell

→ 정적 분석기가 reverse-shell 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1000 B

versions