paperclip-ai @0.1.1

Summary

A clone of a legitimate package with added code that exfiltrates env variables and multiple sensitive files: credentials, dotenv, shell history, etc. Exfiltrated credentials were quickly validated by the attacker. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-browser-use-headless Reasons (based on the campaign): - files-exfiltration - exfiltration-env-variables - exfiltration-credentials - clones-real-package

Source: kam193 (643de4cab1ea2f7becbca5a7dead46fcb39f35596d2bf7a371fdd2c82ded1530)