npm credential and data exfiltration reports.

The package performs unconsented install-time fingerprint exfiltration and explicitly identifies itself as a dependency-confusion proof of concept. No benign functionality offsets this co...

Direct source inspection confirms unconsented install-time host-data exfiltration to an external endpoint. This is concrete malicious behavior, not a scanner-only signal.

Direct source inspection confirms an install-time host-fingerprinting exfiltration chain. The declared dependency-confusion proof-of-concept description reinforces malicious intent.

Direct source inspection confirms unconsented install-time host-data exfiltration. The nested archive contains the same manifest and script.

This is concrete, unconsented install-time host-data exfiltration, corroborated directly in the manifest and source.

Source directly confirms unconsented install-time collection and exfiltration of host-identifying data. This is concrete malicious behavior, not a benign package-aligned network action.

Direct source inspection confirms unconsented install-time exfiltration and remote-access persistence. This is concrete malicious behavior, not a package-aligned feature.

Direct source inspection confirms deliberate credential exfiltration on the exported runtime path. The lack of lifecycle scripts limits automatic execution but does not remove the concret...

This is not date-parsing functionality: source inspection confirms obfuscated browser injection and unconsented data exfiltration activated by the exported API. The lack of lifecycle hook...

Source inspection confirms a concrete browser-side form-data exfiltration chain activated by the package's exported API. The absence of install hooks does not mitigate the malicious runti...

Source inspection confirms malicious runtime behavior behind the package’s exported date parser. Lack of lifecycle hooks limits installation-time exposure but does not mitigate the activa...

The normal entrypoint is inert, but the intentionally deceptive export activates import-time persistence of a handler designed to harvest sensitive host files. No lifecycle hook is requir...

This is concrete secret-harvesting and application-file mutation hidden behind a deceptive export, despite lacking an install hook or direct network call.

Direct source inspection confirms automatic postinstall execution and outbound transmission of host-identifying data to an attacker-controlled callback endpoint.

The package contains a concrete, automatic, non-package-aligned host-fingerprinting exfiltration chain at install time. The normal SDK entrypoint does not justify this hidden telemetry.

This is concrete, unconsented install-time reconnaissance and exfiltration unrelated to the advertised GraphQL generator.

Concrete postinstall credential collection and transmission are present in source. The package should be blocked.

The postinstall hook contains concrete, unconsented command execution and credential-related environment harvesting with network forwarding. The benign runtime export does not mitigate th...

This is concrete, obfuscated install/import-time metadata exfiltration, unrelated to the advertised utility package. The generic network helper does not mitigate the malicious DNS beacon.

Concrete install-time, obfuscated host-fingerprint exfiltration is present and unrelated to the advertised utility package. This is malicious behavior, not a benign network helper.

The package is a concealed remote data-collection and input-automation tool unrelated to its stated system-binary configuration purpose. Although no install hook runs it automatically, ex...