npm credential and data exfiltration reports.

Direct source inspection found a deceptive, obfuscated redirect that forwards browser query parameters to a concealed endpoint. The absence of npm lifecycle hooks does not mitigate this r...

Direct source inspection confirms concrete credential/session theft and exfiltration behavior in index.js. The lack of lifecycle hooks limits automatic activation but does not negate the...

The payload implements concrete credential harvesting and exfiltration, not merely risky primitives. Lack of an install hook limits automatic activation but does not make the directly exe...

Direct source inspection confirms unconsented install-time transmission of local host identity data to an opaque endpoint. This is concrete data exfiltration, not merely a noisy static he...

The unconsented postinstall collection and remote transmission of local host/user/path data is concrete install-time exfiltration. The runtime SDK code does not mitigate that behavior.

Direct source inspection confirms unconsented install-time host-fingerprint exfiltration. This is concrete malicious behavior, not a package-aligned feature.

Direct source inspection confirms an automatic install-time credential-exfiltration chain with no package-aligned purpose.

The package implements unconsented install-time secret collection and external exfiltration. Its comments and error suppression do not alter the concrete behavior.

Direct source inspection confirms install-time credential collection and external exfiltration, unrelated to the claimed AMM contracts/ABIs package.

Direct inspection confirms an install-time credential/system-data exfiltration chain. This is concrete malicious behavior, not a scanner-only inference.

The deceptive UI, intentional concealment, and unconditional forwarding of browser query data to an obfuscated destination establish a concrete exfiltration chain. Lack of install hooks d...

Direct source inspection confirms a concealed redirect chain, not merely a static scanner signal. Although it has no install hook, its browser payload is concretely deceptive and forwards...

The only declared entrypoint is a deceptive, obfuscated redirector rather than a legitimate npm library. Its runtime behavior establishes a concrete phishing/data-transfer attack surface.

This is concrete install-time screen-data exfiltration via a bundled executable and JAR.

This is concrete, covert data-exfiltration behavior embedded in a package whose declared npm entrypoint is absent. Lack of an install hook reduces install-time exposure but does not make...

The source directly implements credential theft, remote command execution, C2 communication, and wallet draining; missing declared dependencies may impair execution but do not change its...

Direct source inspection confirms an install-triggered external exfiltration callback. The benign placeholder runtime export does not mitigate the postinstall behavior.

Direct source inspection confirms unconsented install-time collection and external transmission of local system data. This is concrete credential/system-data exfiltration behavior.

The source contains a concrete credential- and input-exfiltration chain to a hard-coded external receiver. Lack of an install hook and explicit init call reduce automatic reachability but...

Direct inspection confirms a concrete, obfuscated query-parameter exfiltration and redirect chain in the only shipped entrypoint. The absence of npm lifecycle hooks does not remove the ma...

Direct source inspection confirms automatic install-time network exfiltration of a host identifier. Although limited in scope, it is concrete behavior rather than a scanner-only signal.