Reverse-shell payload — 1 caught | Cremit · NHI Credential Stealer Index

AUTO-PUBLISHED/kitchen-sink · 8/npm/2026-06-06

purpclaw5 versions·0.1.0→0.1.4

by rojoedjhdopdrhjzdhfojzdopthj

Open-source coding-agent CLI. Terminal-first, multi-agent, self-improving. Supports OpenAI, Anthropic, Gemini, Ollama, and 13 more providers.

steals →GitHub PATSSH keysAI API keysDiscord tokensSlack tokens

reads-env-varschild-process-spawnreads-ai-api-keyspublic-github-pushreads-homedirreads-system-inforeverse-shellclipboard-access+7

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

6.5 MB

versions

AUTO-PUBLISHED/npm/2026-06-06

rtexit-method4 versions·0.1.18→0.1.28

by ahmed_samir_53

RTExit - AI-assisted Red Team methodology installer

→ sends tohttps://github.com/exit-code-eg/RTExit.git

public-github-pushinvokes-secret-scannerchild-process-spawncurl-pipe-basharchive-then-uploadbase64-decodereverse-shellreads-env-vars

→ Static analyzer matched curl-pipe-bash: unambiguous remote-code-execution shape in the install path.

weekly

1.9K

/wk

llm verdict

malicious 0.95

h-score

patterns

size

3.3 MB

versions

AUTO-PUBLISHED/npm/2026-06-03

internallib_v346@1.0.3

by b4lr0g

child-process-spawnreverse-shell

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1.6 KB

versions

AUTO-PUBLISHED/npm/2026-05-25

system-user-identifier-cli3 versions·5.0.0→7.0.1

by ayoung299

A simple npx tool to check system user identifier

reads-homedirreads-system-infochild-process-spawnreverse-shell

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

1000 B

versions