384 versions across 34 packages with live AWS/GitHub credential validation before exfil — they're not spraying, they're hunting. Zero-width Unicode in .cursorrules and CLAUDE.md weaponizes AI coding assistants into running fake "security scans" that leak the env, which is the part that actually scales beyond crypto. Rust's memory safety guarantees go to zero when build.rs is arbitrary code execution on every cargo build, and routing exfil through GitHub Gists ships identity tokens out via the same platform that holds them.

Top comment by @Benthic