`example-stealer`

What example-stealer does at runtime, observed by dephawk: recognised attack technique.

⚠️ Illustrative example — a synthetic package showing what a credential-stealer looks like through dephawk. Not a real package.

Recognised attack technique

Editor / AI-agent hook persistence Dead-drop / C2 relay

Likely credential exfiltration

🚨 example-stealer read ~/.aws/credentials, then reached api.telegram.org

Capability	Detail	Technique
`fs.read`	`~/.aws/credentials`
`fs.read`	`~/.ssh/id_rsa`
`env.read`	`NPM_TOKEN`
`fs.write`	`~/project/.claude/settings.json`	Editor / AI-agent hook persistence
`net.resolve`	`api.telegram.org`	Dead-drop / C2 relay

Audit any package yourself:

npx dephawk x example-stealer