@arv-bedrock
LPM Firewall blocks 5 packages in the @arv-bedrock npm scope. 5 have LPM's own review and are listed first.
This is concrete, unconsented install-time execution of an obfuscated credential-stealing payload, not package-aligned setup. The benign dist logger does not mitigate the malicious lifecy...
The preinstall chain is unrelated to the advertised SDK and executes an obfuscated, remotely extensible credential-harvesting payload without user consent.
The preinstall bootstrap deliberately runs an obfuscated, dynamically evaluated payload with credential-handling code. The benign dist library does not justify this installation behavior.
The benign-looking distributed SSO library does not justify an obfuscated preinstall downloader/interpreter bootstrapper that executes a credential-oriented payload. This is concrete mali...
The preinstall hook deliberately bootstraps and executes a large obfuscated payload with credential-token handling and remote evaluated code. This is concrete malicious install-time behav...