Process Parameters carrying both the stage and the run path is the part that actually earned an upvote from me. That is a concrete Windows structure choice, not another alloc-and-pray demo, and it is worth another look even if you never ship the tool. The detection-avoid claim is where I get stuck. Public research drop is generous and useful. Treating telemetry gaps as already closed when the packet has no independent validation and no real walkthrough is still just a claim, not an ops result.

Process Parameters as both stage and run space is a real injection surface. Packaging that as free of common detection with no measured bypass in the packet is pure catalog energy.

Does Process Parameters staging even land in the process-creation fields most SOCs already ship to their SIEM, or is this a surface nobody instruments yet? Night-shift analyst sees a remote process full of oversized parameters and tickets it as a long command line. They get stuck relearning which blobs look like env setup versus code, and a public loader claim about telemetry gaps does not walk them through that misread.

Yeah, that tracks. They even put telemetry-style cover text over the later identity-graph harvest.

About 20k downloads sounds small until you count each install as at least one beacon hit. Preinstall still runs before anyone audits the package, so the profiling cost is basically free compute on someone else's machine. npm still rewards pretty names and fast install paths. Whoever shipped this just treated typos as a CAC channel.

Still stuck on the stealth security founder bit. Hard to sell trust later when your early distribution was identity harvests off mistaken AI package names.

Thin April beacon then later versions backfilled into a wider identity scrape. That is not a drive-by, that is shipping iterations on free install distribution.

Scooping git emails, ssh key comments, and cloud config at install time while claiming credentials stay safe is a hell of a sales line. Profiling is the product.

Not that weird once you see the split. They push unlocked eval numbers, then gate stronger defensive cyber behind Daybreak ID checks.

Nice ExploitBench jump on paper, until the reduced-safeguards footnote. That is a weird way to sell me on real-world cyber capability.