npm credential and data exfiltration reports.

Direct source inspection confirms an automatic, obfuscated install-time payload that harvests credentials and evaluates remote code. The benign configuration helper does not mitigate this...

The install hook provides a concrete, unconsented execution chain into an obfuscated credential-focused payload with remote eval. This is malicious behavior, not package-aligned configura...

Concrete source behavior establishes malicious install-time staged execution and credential-focused payload logic. The advertised entrypoint provides no functional configuration and inste...

The unconsented preinstall execution chain delivers and runs an obfuscated credential-collection payload. This is concrete malicious behavior, not a package-aligned setup step.

Concrete install-time remote bootstrap and execution of an obfuscated credential-oriented payload establishes malicious behavior. The normal ESLint entrypoint does not mitigate the preins...

Source inspection confirms a concrete install-time remote-runtime bootstrap followed by an obfuscated credential-harvesting payload. This is not required by the advertised web-chat client...

The malicious behavior is directly wired into preinstall and concealed in an unrelated obfuscated payload; the benign runtime module does not justify it.

This is concrete, unconsented install-time execution of an obfuscated payload with remote eval and credential-oriented functionality, not normal chat-client behavior.

The benign example sources do not explain an obfuscated preinstall payload that evaluates network content and processes GitHub tokens. This is concrete malicious install-time behavior.

The automatic execution chain and obfuscated token-oriented payload establish concrete malicious install-time behavior. The scaffold CLI and normal template artifacts do not explain it.

The third-party credential submission is enabled by the default API-server setting and reached by the package's automatic recovery path. No install hook is needed for this runtime credent...

The package’s claimed rule-pack purpose does not require secret collection or external transmission. Source directly implements credential and host-data exfiltration despite lacking an in...

The package has no apparent package-aligned reason to collect and transmit this system data during installation. The exfiltration is concrete and automatically triggered.

Direct source inspection confirms an unconsented install-time data-exfiltration chain. The package has no apparent functional implementation beyond this behavior.

The package performs no location-related function; its install hook exists to transmit a machine identifier through DNS. This is concrete install-time data exfiltration.

The install-time source contains a concrete credential-exfiltration chain; the advertised arithmetic functionality does not justify it.

The package has no declared functionality beyond an automatic preinstall script that covertly sends local host metadata over DNS. This is concrete, unconsented install-time data exfiltrat...

Concrete obfuscated metadata collection and DNS exfiltration execute automatically at install and import. This is unrelated to the package’s stated utility/descriptors purpose.

Source confirms a credential-bearing endpoint redirection, not merely a benign setup helper. The lack of an install hook does not remove the concrete credential-exfiltration chain trigger...

The concealed outbound request, silent failure handling, and complete mismatch with the package name establish a concrete data-exfiltration capability. There is no install hook, but runti...

The source implements a concrete credential-routing configuration change, not a normal Anthropic setup. The absent manifest entrypoint limits activation but does not make the source behav...