Static pattern: session-start-hook

@bolloon/bolloon-agent8 versions·0.1.16→0.1.28

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

→ Credential read (reads-ai-api-keys, reads-seed-phrase) paired with http-to-public-ip, dest-via-hostname-var destination — classic exfiltration signature.

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

ms-graph-types@2.43.2

Types for Microsoft Graph objects

microsoft-applicationinsights-common@3.4.2

Microsoft Application Insights Common JavaScript Library

crypto-javascri@3.0.1

JavaScript cryptography library providing hashing, HMAC, PBKDF2, AES encryption, and encoding utilities

fulcrum-sessions@1.3.0

Local proxy server that manages multiple Claude Code sessions with Telegram integration, LinkedIn posting, voice transcription, and Unsplash image search through a single bot connection per machine

→ Sends to suspicious destination(s): api.telegram.org.