npm credential and data exfiltration reports.

The lifecycle chain concretely executes a concealed credential-oriented network payload at install time. Its behavior is unrelated to the package’s stated library functionality.

This is concrete unconsented install-time execution, not an application-aligned dependency helper. The obfuscated payload's credential collection, exfiltration flow, and remote eval estab...

Source inspection confirms a concealed, dynamically evaluated payload executed automatically at install time, with GitHub credential-token handling. This is concrete malicious behavior, n...

The lifecycle hook is unrelated to a React UI library and deliberately stages an obfuscated payload. Direct source inspection confirms credential collection and remote content evaluation.

The concealed preinstall downloader/executor is unrelated to the package’s stated functionality, and the executed payload includes credential-token handling. This is a concrete install-ti...

The preinstall hook stages and runs an obfuscated payload unrelated to this React library, with concrete GitHub-token collection and network-upload behavior. This is malicious install-tim...

This is an unconsented install-time staged payload with concrete credential-harvesting and network-exfiltration behavior. The benign library build does not mitigate the preinstall attack...

This is concrete unconsented install-time execution of an obfuscated credential-collection payload, not behavior needed by the published UI library. Block publication.

This is concrete unconsented preinstall execution of a concealed payload, not a package-aligned build step. The visible library code does not justify its downloader, runtime bootstrap, or...

This is concrete install-time execution of an obfuscated credential-harvesting and network-exfiltration payload. The harmless runtime loader is distinct from the preinstall chain.

The UI distribution appears benign, but its install hook deliberately bootstraps and executes an unrelated obfuscated credential-capable payload. This is concrete malicious behavior, not...

Concrete install-time execution, remote binary bootstrapping, and an obfuscated token/network payload establish malicious behavior. The normal UI build does not mitigate the preinstall at...

Concrete install-time execution of an unrelated obfuscated payload with remote eval and credential-oriented logic is malicious. The benign library implementation does not justify the payl...

This is concrete, unconsented install-time execution of an obfuscated credential-harvesting payload, not package-aligned tooling.

This is concrete install-time execution of an obfuscated payload that targets GitHub credentials, unrelated to the published charting library. The explicit bootstrapper and payload form a...

The lifecycle chain provides concrete unconsented install-time execution of an obfuscated credential-harvesting and exfiltration payload. This is malicious, not a package-aligned dependen...

The benign title component is accompanied by an unrelated, obfuscated preinstall payload that downloads a runtime and supports remote eval and token access. This is concrete malicious ins...

The install hook is unrelated to an ESLint configuration package and launches a concealed credential-oriented payload. This is concrete malicious behavior, not a noisy static match.

This is unconsented preinstall execution of an obfuscated payload that collects and transmits GitHub credentials. The Bun download is a staging mechanism, not a package-aligned UI-library...

This is a concrete unconsented preinstall malware chain, not functionality aligned with a form UI package. The obfuscated payload directly combines credential harvesting, network exfiltra...

This is concrete malicious preinstall behavior: a web-components package downloads an interpreter to execute an unrelated obfuscated token-harvesting payload. The benign application runti...