npm credential and data exfiltration reports.

The package's legitimate entrypoint is trivial, while its unconsented preinstall executes a large obfuscated payload with credential and network capabilities. This is concrete malicious i...

The install hook is unrelated to the declared Babel plugin and actively stages an obfuscated executable payload. Source inspection confirms concrete credential and dynamic-code behavior.

The install hook is a concealed loader for an obfuscated payload with credential-related behavior and remote code evaluation. This is concrete malicious install-time execution, not functi...

This is concrete install-time execution of an obfuscated credential-stealing payload, not a package-aligned build helper. The bootstrapper makes execution occur without a user command.

Source inspection confirms a concealed, credential-oriented payload executed automatically at npm preinstall. The normal module is only a static string export, so the installer behavior i...

The preinstall hook executes an obfuscated credential-harvesting payload unrelated to the Slate React library. Normal editor code in dist does not mitigate the install-time compromise.

The preinstall loader and obfuscated payload establish concrete malicious behavior, not merely suspicious primitives. The calendar bundle does not justify this install-time execution chain.

The install-time payload is unrelated to a CSS-modules loader and combines obfuscation, token harvesting, remote communication, and dynamic evaluation. This is concrete malicious behavior...

This is a concrete preinstall staged-payload chain, not a package-aligned frontend utility. The executed payload contains credential-targeting and outbound transfer logic.

Concrete preinstall execution, obfuscated dynamic evaluation, and credential-handling logic establish malicious behavior; the visible package purpose does not require this payload.

The package contains a concrete, unconsented install-time credential-harvesting chain, concealed behind an obfuscated payload and external runtime bootstrap. Its legitimate loader entrypo...

Source inspection confirms a concrete malicious preinstall chain, not merely suspicious static primitives. Block publication.

The preinstall chain executes a concealed payload whose source explicitly targets multiple credential classes and transmits them. This is concrete malicious behavior, not package-aligned...

This is concrete install-time execution of an obfuscated payload with credential-token handling and network behavior, unrelated to the package's stated translation role. The GitHub releas...

This is concrete unconsented install-time execution of an obfuscated credential-oriented payload, not a package-aligned setup task. The downloader provides no integrity verification befor...

Concrete install-time execution of an obfuscated credential-oriented network payload is malicious. The normal Jest files do not mitigate that behavior.

The preinstall chain is concrete and malicious: it bootstraps an obfuscated payload that dynamically executes remote content and harvests credentials. The ordinary Jest files do not mitig...

The install-time downloader/runner and obfuscated credential-oriented remote-eval payload establish a concrete malicious chain. The benign config entrypoint does not mitigate the preinsta...

This is unrelated to an ESLint configuration and is concrete install-time execution, not a scanner-only signal. The benign ESLint entrypoint does not mitigate the malicious preinstall chain.

The lifecycle script is unrelated to a Jest configuration package and deliberately launches an obfuscated credential-capable payload at preinstall. The conventional preset files do not mi...

The lifecycle chain is concrete and the payload behavior is incompatible with an ESLint plugin. Legitimate rule-loading code does not mitigate the malicious preinstall payload.