crypto-javas@2.0.9

One or more suspicious static signals were detected.

`npm install` executes `postinstall`; importing `index.js` executes `autoExecute()`.

Secrets, CI tokens, repository metadata, host details, and local network IP can be disclosed to a backend selected from project-controlled configuration.

automatic environment harvesting and HTTPS credential/data exfiltration

The package installs a lifecycle script that enumerates almost all environment variables, adds host and CI metadata, discovers a backend URL and API key from environment or project-local configuration, then POSTs the assembled payload. The same collection-and-send path also runs automatically whenever the package main module is imported. This is covert secret-exfiltration behavior, not a package-aligned utility operation.

Static source inspection confirms unconsented install-time and import-time environment harvesting followed by network transmission. Conditional backend configuration does not remove the concrete exfiltration capability or its automatic triggers.