npm credential and data exfiltration reports.

Direct inspection confirms a concrete, obfuscated query-parameter exfiltration and redirect chain in the only shipped entrypoint. The absence of npm lifecycle hooks does not remove the ma...

Direct source inspection confirms automatic install-time network exfiltration of a host identifier. Although limited in scope, it is concrete behavior rather than a scanner-only signal.

Source inspection confirms a concealed redirect to a Microsoft-lookalike domain, not a benign package function. Absence of install hooks does not mitigate the browser phishing payload.

Source inspection shows a deceptive browser flow with obfuscated external redirect and query forwarding; it is unrelated to a plausible npm package function. Absence of install hooks does...

The only executable package entrypoint contains a concrete obfuscated redirect to a likely phishing domain, not a legitimate package function. Absence of install hooks does not remove the...

The hardcoded remote credential store is reached by the normal pairing path and persists sensitive WhatsApp authentication state without user-provided database configuration. This is conc...

The postinstall hook directly triggers heavily obfuscated local-file collection and axios multipart upload code. This is malicious install-time data exfiltration, not package-aligned beha...

Direct source inspection confirms an install-time exfiltration and persistence chain, not merely suspicious primitives. The README is unrelated to the executable code.

Direct source inspection confirms an automatic install-time secret-harvesting and exfiltration chain. This is concrete malicious behavior, not a package-aligned network use.

Direct source inspection confirms an automatic install-time credential and wallet-file exfiltration chain. This is concrete malicious behavior, not a noisy static signal.

This is concrete, unconsented install-time execution of an obfuscated credential-stealing payload; the Bun bootstrap is used to ensure it runs. The legitimate-looking CI orb content does...

Direct inspection confirms an install-time bootstrapper executing an obfuscated credential-oriented remote payload. This is concrete malicious supply-chain behavior, not a legitimate conf...

Source inspection confirms an automatic preinstall chain into an obfuscated payload with credential-oriented logic and remote eval. This is concrete malicious behavior, not a benign build...

Concrete install-time execution leads to an obfuscated payload with credential collection and upload behavior. The benign example sources do not justify this installer chain.

Source inspection confirms a concrete install-time bootstrapper for an obfuscated credential-harvesting/exfiltration payload. This is malicious behavior, not a package-aligned build depen...

This is concrete install-time execution of an obfuscated credential-oriented remote-code payload, not functionality aligned with a React component library.

The lifecycle execution, downloaded interpreter, obfuscated payload, remote eval, and credential logic form a concrete malicious chain unrelated to documentation delivery.

The install-time execution chain runs an unrelated, heavily obfuscated payload with credential-focused and remote-code capabilities. This is concrete malicious behavior, not a package-ali...

Concrete install-time execution of an obfuscated credential-harvesting payload establishes malicious behavior. The legitimate-looking UI bundles do not mitigate the preinstall attack path.

The benign lint-rule entrypoint does not justify the preinstall bootstrap or its obfuscated token-oriented payload. This is concrete malicious install-time behavior.

The install hook executes a concealed, unrelated payload with remote eval and GitHub-token handling; this is concrete malicious behavior, not package-aligned setup.