npm credential and data exfiltration reports.

The package contains concrete default-on outbound collection of organization identity and runtime event data to a package-controlled endpoint. Although it has an opt-out and no install ho...

The source establishes a default outbound telemetry path that receives all init arguments, including a credential-bearing option. This is concrete credential exfiltration during normal CL...

This is concrete, automatic data exfiltration on import, not package-aligned functionality. The absence of an install hook does not mitigate the import-time behavior.

This package automatically exfiltrates an environment credential in a preinstall hook, while its stated validation does not enforce a result. The icon runtime code appears benign, but it...

The package contains no automatic npm install hook, but its user-invoked authentication flow deliberately delegates Google credential collection to an unrelated GitLab Pages domain. This...

The source establishes automatic runtime collection and transmission of user repository metadata to an undisclosed private endpoint. The absence of an npm lifecycle hook limits the trigge...

The fixed gateway receives a caller’s API credential at runtime, which is not necessary for a local investment utility and creates a concrete credential-exfiltration path. The package als...

The source establishes a concrete credential and environment disclosure path to a remote endpoint in the default execution mode. The absence of lifecycle hooks limits activation to MCP us...

Source directly establishes a fixed remote credential destination and persistent session handling. The explicit command trigger does not remove the credential-exfiltration risk of the unv...

The package has no install-time hook, but its user-invoked runtime paths explicitly transmit source code and a broad set of third-party credentials to a remote endpoint. This is concrete...

The hardcoded remote logger automatically exports broadly captured client logs, including mail-operation objects, to an unrelated external host. The local-only postinstall hook does not r...

The package contains an automatic external logging channel that receives serialized account IMAP settings. Its local-only postinstall hook does not mitigate this runtime credential-exfilt...

The package contains concrete, automatic transmission of user account and cloud-storage metadata to an unrelated endpoint. Its benign workspace-link postinstall hook does not mitigate tha...

The package automatically exports account metadata and broad console telemetry to an external host. This is a concrete, privacy-impacting exfiltration channel.

This is concrete user-triggered bulk file exfiltration to a source-controlled Telegram destination, inconsistent with the package identity. The absence of an install hook does not remove...

The browser extension combines broad page access, credential collection, and transmission to a hard-coded external host. The lack of an npm install hook does not mitigate this concrete cr...

The package contains a concrete runtime data-exfiltration path to an embedded external receiver, not merely a general-purpose request API. Its lack of an install hook limits the trigger b...

The package embeds active external webhook destinations in multiple runtime workflows and automatically transmits constructed log records to them. This is concrete data exfiltration behav...

The package contains an exported runtime path that exfiltrates supplied phone numbers to an unrelated host with a deliberately abusive header. Although not automatic, this is concrete mal...

The package embeds active third-party collection endpoints as defaults and exports application records to them during ordinary runtime. This is concrete unconsented data exfiltration, des...

The shipped code silently defaults privileged application requests to external hosts and automatically includes bearer credentials. This is concrete credential and data exfiltration behav...