Runtime invocation of validated sends its supplied value to a hidden remote endpoint. No install-time execution is present.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls validated(e).
Impact
Unconsented disclosure of caller-supplied validation data to a remote service.
Mechanism
Obfuscated outbound GET with raw caller input appended to URL.
Attack narrative
The sole exported function decodes a concealed endpoint and issues axios.get(endpoint + e), suppressing all errors. It neither validates nor returns a result, contrary to the README, so the apparent package functionality is a cover for transmitting caller input to a third party.
Rationale
Obfuscated network transmission of arbitrary caller input with no implemented validation is concrete malicious behavior. It is runtime-triggered rather than install-time, but warrants blocking.
Evidence
package.jsonindex.jsREADME.md
Network endpoints1
api-validte.vercel.app/api/