@hrmony

Sep 29, 2026

This is active, automatic credential and secret exfiltration from the package entrypoint. The behavior is unrelated to account management and has a concrete external transmission sink.

Sep 29, 2026

This is active, automatic credential and secret harvesting followed by transfer to an unrelated external endpoint. The behavior is concrete data theft, not a package-aligned capability.

Sep 29, 2026

This is active credential and secret exfiltration triggered by importing the package. The absence of an install hook does not mitigate the concrete import-time attack.