npm credential and data exfiltration reports.

The automatic, unfiltered browser-cookie export followed by forwarding those values to Instagram is a concrete credential-exfiltration path. The absence of an install hook does not remove...

The package has no install hook, but its shipped server contains an unrelated email and data-collection backdoor with an embedded credential. That concrete hidden capability warrants bloc...

Source inspection confirms automatic, unprompted persistence and transmission of a unique installation identifier on ordinary CLI execution. The explicit agent configuration commands are...

The package performs automatic install-time extraction and network transmission of an environment credential. This is a concrete credential-exfiltration surface, regardless of the stated...

The package has a concrete automatic credential-exfiltration path in its preinstall hook. Swallowing invalid-license errors makes the stated validation ineffective while preserving the se...

The package has a concrete preinstall credential-transmission path. Its narrow scope reduces impact, but source inspection cannot establish that the recipient is authorized to receive the...

The package performs automatic install-time transmission of an environment credential. Static inspection found no other execution or mutation behavior, but this concrete credential-exfilt...

The package has a concrete automatic install-time credential exfiltration path. The otherwise static icon exports do not mitigate the preinstall behavior.

The package has a concrete install-time credential-exfiltration path. The absence of additional payload behavior does not remove the risk of automatically transmitting an environment secret.

The package performs automatic install-time transmission of an environment credential to a remote endpoint. No user command is required, so this is credential exfiltration behavior rather...

The automatic preinstall hook exports an environment credential to a remote service while swallowing invalid-license failures. This is concrete credential exfiltration at install time.

The automatic preinstall hook exports an environment credential to a remote service, while validation failures do not enforce a license. That is concrete credential-exfiltration behavior...

The package automatically transmits a named environment credential during preinstall while suppressing invalid-license failures. That concrete credential-exfiltration behavior warrants bl...

This icon package has an automatic installation hook that exfiltrates an environment credential to a remote endpoint. The behavior is concrete and does not require importing the package.

The package contains an automatic preinstall credential-transmission path. Its icon exports do not require this install-time secret disclosure, making the behavior concrete credential exf...

The package performs unconsented install-time credential transmission. Its icon exports do not require this behavior, so the lifecycle hook forms a concrete credential-exfiltration attack...

The package has a concrete install-time credential-exfiltration path. Its icon exports do not require this behavior, and the validation result is non-enforcing.

The automatic lifecycle hook exports an environment credential to a remote server. This is concrete install-time credential exfiltration, so the package should be blocked.

This icon package performs automatic preinstall credential disclosure. The hook transparently targets one named variable, but automatic export of an environment secret to a remote service...

This package automatically transmits an environment credential during preinstall. The source establishes a concrete credential-exfiltration path, so it should be blocked.