npm credential and data exfiltration reports.

The package contains no automatic npm install hook, but its user-invoked authentication flow deliberately delegates Google credential collection to an unrelated GitLab Pages domain. This...

The source establishes automatic runtime collection and transmission of user repository metadata to an undisclosed private endpoint. The absence of an npm lifecycle hook limits the trigge...

The fixed gateway receives a caller’s API credential at runtime, which is not necessary for a local investment utility and creates a concrete credential-exfiltration path. The package als...

The source establishes a concrete credential and environment disclosure path to a remote endpoint in the default execution mode. The absence of lifecycle hooks limits activation to MCP us...

Source directly establishes a fixed remote credential destination and persistent session handling. The explicit command trigger does not remove the credential-exfiltration risk of the unv...

The package has no install-time hook, but its user-invoked runtime paths explicitly transmit source code and a broad set of third-party credentials to a remote endpoint. This is concrete...

The hardcoded remote logger automatically exports broadly captured client logs, including mail-operation objects, to an unrelated external host. The local-only postinstall hook does not r...

The package contains an automatic external logging channel that receives serialized account IMAP settings. Its local-only postinstall hook does not mitigate this runtime credential-exfilt...

The package contains concrete, automatic transmission of user account and cloud-storage metadata to an unrelated endpoint. Its benign workspace-link postinstall hook does not mitigate tha...

The package automatically exports account metadata and broad console telemetry to an external host. This is a concrete, privacy-impacting exfiltration channel.

This is concrete user-triggered bulk file exfiltration to a source-controlled Telegram destination, inconsistent with the package identity. The absence of an install hook does not remove...

The browser extension combines broad page access, credential collection, and transmission to a hard-coded external host. The lack of an npm install hook does not mitigate this concrete cr...

The package contains a concrete runtime data-exfiltration path to an embedded external receiver, not merely a general-purpose request API. Its lack of an install hook limits the trigger b...

The package embeds active external webhook destinations in multiple runtime workflows and automatically transmits constructed log records to them. This is concrete data exfiltration behav...

The package contains an exported runtime path that exfiltrates supplied phone numbers to an unrelated host with a deliberately abusive header. Although not automatic, this is concrete mal...

The package embeds active third-party collection endpoints as defaults and exports application records to them during ordinary runtime. This is concrete unconsented data exfiltration, des...

The shipped code silently defaults privileged application requests to external hosts and automatically includes bearer credentials. This is concrete credential and data exfiltration behav...

The package embeds unconsented credential-harvesting instructions into every agent task and provides ungated absolute-path reading. Although it has no install hook, this is concrete runti...

This package performs unconsented install-time system mutation and automatically accesses foreign credential stores during normal startup. The behavior is concrete and high impact even th...

The package contains a concrete credential-collection and external-upload path with a hard-coded remote default. The lack of an install hook and the confirmation prompt reduce stealth but...

The package contains a concrete automatic remote logging path to package-embedded webhook URLs and serializes potentially sensitive application records for it. This is data exfiltration b...