npm credential and data exfiltration reports.

The sole package behavior is an automatic install hook that harvests ECS metadata and transmits it to an unrelated external endpoint. This is a concrete exfiltration chain, not a package-...

The only package source defines an automatic install-time collection and exfiltration chain targeting ECS metadata and host identity.

The only package file defines an install-time metadata-harvesting and external-exfiltration chain. This is concrete malicious behavior, not a package-aligned operation.

The sole package behavior is an install-time collection-and-exfiltration pipeline targeting ECS metadata and an unrelated external host.

Direct source inspection confirms an install-time cloud-metadata exfiltration chain to an external endpoint.

Source inspection confirms unconsented install-time collection and transmission of local environment metadata to a callback domain. This is concrete data exfiltration behavior.

Direct manifest inspection confirms two install-time scripts that fingerprint and exfiltrate the installer environment to an unrelated external callback domain. The empty runtime entrypoi...

The package performs unconsented install-time environment fingerprinting and external transmission, with no functional code that would justify it. This is concrete data exfiltration behav...

Direct source inspection confirms two automatic install hooks that exfiltrate host and environment metadata to an unrelated callback domain. The package provides no corresponding runtime...

Direct manifest inspection confirms duplicated install-time collection and outbound callback requests. The empty entrypoint and generic README provide no package-aligned purpose for the b...

The preinstall network requests exfiltrate machine and account identifiers without a user command or package functionality justification. This is concrete install-time data exfiltration.

The package performs unconsented install-time transmission of host-derived identifiers to an external domain, which is concrete data exfiltration. Its explicit runtime API upload does not...

The automatic preinstall network requests encode local identity data into attacker-observable OAST subdomains. This is a concrete unconsented install-time exfiltration chain.

The automatic hostname disclosure to an OAST endpoint is concrete install-time exfiltration behavior. The local harvesting and remote content-upload path reinforce that this is not a beni...

This is concrete unconsented install-time collection and exfiltration of host/project context. The benign utility exports do not justify the lifecycle telemetry.

The package performs unconsented, install-time transmission of host and installation-context data to an unrelated webhook endpoint. Its normal runtime entrypoint is benign, but the lifecy...

The package’s preinstall hook performs a concrete, automatic outbound collection of host and installation metadata to a third-party webhook. The normal runtime entrypoint does not mitigat...

This is concrete credential exfiltration triggered by normal module import, with obfuscation and self-removal for concealment. The legitimate codec exports do not mitigate the appended ma...

Source inspection confirms a concrete runtime data-exfiltration path in both distributed entrypoints. The absence of install hooks does not mitigate the malicious library-call behavior.

Direct inspection establishes an install-triggered surveillance and remote-control chain, plus optional persistence. This is concrete malicious behavior, not a noisy binary-artifact signal.

The source implements concrete, unconsented install-time host-data exfiltration to external endpoints. The stated research purpose does not remove the active collection and transmission b...