npm credential and data exfiltration reports.

The package contains a default-enabled remote execution path that transmits a runtime session value and request data to a hard-coded external endpoint. This is concrete credential and dat...

Automatic installation-time transmission of an environment credential is concrete credential-exfiltration behavior. The package contains no evidence that the installer independently conse...

The package has an automatic preinstall hook that sends an environment credential to a remote host. This is concrete credential exfiltration during installation, despite the absence of ot...

The automatic preinstall hook exports an environment credential over the network. The absence of payload execution does not remove the concrete credential-exfiltration surface.

The automatic lifecycle hook collects and transmits a credential, creating concrete install-time credential-exfiltration behavior. No broader payload, persistence, or filesystem mutation...

This is concrete automatic credential transmission at install time, and the purported validation does not cause installation to fail for invalid responses. The behavior is therefore crede...

The package contains a concrete automatic install-time host-fingerprinting callback to a third-party endpoint. Its simple runtime export does not justify or mitigate that behavior.

Source inspection confirms direct, automatic collection of sensitive browser data and transmission to an unrelated fixed endpoint. The absence of an install hook does not mitigate the mal...

The package performs automatic install-time transmission of an environment credential, while suppressing validation failure. That behavior is a concrete credential-exfiltration risk rathe...

The package uses an automatic preinstall hook to require and transmit an environment secret. The source provides no necessary local functionality for this collection, and it suppresses va...

The package automatically transmits an environment credential during preinstall. This is concrete install-time credential exfiltration, regardless of its claimed license-check purpose.

This icon package automatically exports an environment credential during installation, while its validation result is not enforced. That is concrete install-time credential exfiltration.

The package performs automatic install-time transmission of an environment credential to a remote endpoint. The absence of shell execution or file mutation does not remove the concrete cr...

The package performs unconsented install-time transmission of an environment credential to a remote service. Its normal icon exports do not justify this credential-harvesting lifecycle be...

The package performs unconsented collection of local AI-agent account identity material and automatic third-party telemetry transmission. Hashing does not remove the stable cross-session...

Direct source inspection confirms two automatic lifecycle hooks that exfiltrate local installation metadata to an external Discord webhook. This is concrete malicious install-time data ex...

Automatic install hooks transmit consumer environment identifiers to an unrelated external endpoint. This is concrete unsolicited data exfiltration, so the package should be blocked.

The source contains concrete targeted CSS beacons and a cookie-reading JavaScript payload with an external execution beacon. This is malicious browser-side data and credential targeting,...

This is automatic, concealed DNS exfiltration during installation and import, unrelated to the advertised link utility. The encoded implementation and lifecycle trigger establish concrete...

The package automatically combines a hard-coded external receiver with parent authentication and a mount-time request. The override does not remove the unsafe default path.

This package uses automatic install hooks to exfiltrate local environment metadata to an external service. That is concrete unconsented install-time data collection.