npm credential and data exfiltration reports.

This is concrete, unconsented install-time host-identifying data exfiltration to an external callback endpoint. The minimal package contents do not reduce the confirmed lifecycle attack.

The only package file defines an automatic install-time external callback that fingerprints the installing host. This is concrete unconsented data exfiltration.

This is concrete, unconsented install-time credential/configuration exfiltration. The endpoint is intentionally concealed and the lifecycle hook suppresses errors.

The source confirms automatic lifecycle execution and external DNS transmission of host-derived data. The inert runtime export does not mitigate the install-time behavior.

Source directly confirms an install-time dependency-confusion payload that exfiltrates host metadata to an attacker-controlled endpoint. Its stated research purpose does not remove the co...

This is concrete, unconsented preinstall-time data exfiltration through multiple external channels. The package has no legitimate runtime function beyond the beacon.

This is concrete, unconsented preinstall-time host and project metadata exfiltration to a fixed third-party callback. A stated research purpose does not remove the install-time disclosure.

The source implements automatic preinstall-time collection and external transmission of identifying host and project data. Its stated research intent does not remove the concrete unconsen...

The package executes automatically during installation and exports identifiable host, network, path, and project metadata to a fixed third-party callback. Its stated research purpose does...

Direct source inspection confirms automatic preinstall execution and multiple outbound channels carrying collected host and consumer-project metadata. The declared dependency-confusion Po...

Direct source inspection confirms a reachable preinstall reconnaissance and data-exfiltration chain. This is concrete unconsented install-time behavior, independent of the package's state...

The package automatically performs broad host and project metadata collection during preinstall and exfiltrates it to a third-party callback. Its stated research purpose does not provide...

The package performs concrete, unconsented install-time collection and external exfiltration of system and project data. Its stated research purpose does not remove the active data-exfilt...

This is concrete, unconsented install-time reconnaissance and exfiltration from the consuming environment. Research-oriented labels do not remove the external data-transfer attack surface.

The package's advertised TOTP code is coupled to concrete credential theft, remote exfiltration, and unsolicited payload installation. These behaviors execute automatically at install tim...

This is concrete install-time credential exfiltration plus remote payload placement, unrelated to TOTP functionality. The benign API is a cover and also activates the malicious runner.

The package implements a concrete install-time data-exfiltration chain, regardless of its stated research purpose. Its limited scope does not remove the unconsented collection and externa...

This is concrete install-time credential exfiltration and payload deployment unrelated to a TOTP utility. The behavior is stealth-oriented and activated without user consent.

This is a concrete install-time credential-stealing and payload-dropping chain unrelated to TOTP functionality. The delayed, swallowed-error postinstall increases stealth.

Source confirms automatic preinstall execution and external transmission of identifying host and project data. The stated research purpose does not remove the concrete unconsented exfiltr...

This is concrete install-time credential theft and unauthorized payload installation, unrelated to TOTP utilities. The legitimate TOTP API is a cover and also triggers the malicious routine.