npm credential and data exfiltration reports.

Inspected source proves immediate reconnaissance and external data exfiltration unrelated to popover positioning. The inert default entrypoint limits activation but does not neutralize th...

Inspected source establishes automatic reconnaissance and data exfiltration unrelated to CSS positioning functionality. The absence of install hooks limits the trigger but does not neutra...

Inspected source proves executable host-data exfiltration unrelated to a CSS polyfill. The empty default entrypoint limits activation but does not neutralize the published registry payloa...

Inspected source establishes automatic system reconnaissance and data exfiltration unrelated to CSS polyfill functionality. The registry payload is executable on load, despite the absence...

Inspected source proves automatic system-data exfiltration upon loading the published registry module, unrelated to CSS field sizing. The payload is executable attack code, although ordin...

Inspected source establishes automatic host-data collection and transmission upon registry-module loading. The empty default entrypoint limits activation but does not neutralize the execu...

Inspected source proves automatic host-data collection and transmission in a distributed registry module. This is concrete data exfiltration, despite the absence of install hooks and the...

Inspected source implements concrete data collection and transmission unrelated to accessibility management. The attack activates when the registry asset is evaluated, despite the absence...

Source proves active forwarding of private WhatsApp data to a hardcoded external recipient without a separate consent gate. The token requirement limits activation but does not authorize...

Inspected source establishes automatic forwarding of existing mail passwords to a hardcoded unrelated logging receiver through the active shipped bootstrap. This concrete credential expos...

Inspected source establishes an active, default credential export during Android initialization, independent of the scanner's similarity claims. The hardcoded remote logging sink receives...

Inspected executable code establishes automatic credential export to an external logging host through the active client startup path. The benign install hook does not neutralize this runt...

Inspected active code proves automatic credential export to an external logging receiver unrelated to the authenticated mail destination. The decision rests on the credential source, seri...

Source inspection establishes automatic forwarding of mail authentication configuration to a fixed external receiver during Android initialization. This concrete credential exposure suppo...

Inspected source demonstrates automatic external transmission of host and user information unrelated to CSS utilities. The inert default entrypoint limits activation but does not neutrali...

The inspected source establishes automatic data exfiltration during installation. The security research label does not neutralize the active collection and transmission behavior.

The source establishes automatic, unconsented disclosure of local environment information to an external recipient. Research labels do not neutralize the active exfiltration behavior.

Independent inspection confirms default credential forwarding without mandatory recipient selection, including initial login despite autoLogin=false. The documented relay and its function...

Inspected executable code establishes automatic forwarding of existing mail credentials to an unrelated logging recipient. This concrete default credential export supports blocking regard...

The source establishes automatic, unconsented export of potentially private tool data to a fixed external recipient. This concrete data exfiltration supports blocking independently of the...

The active preinstall hook performs unconsented environment-data exfiltration unrelated to the package's runtime functionality. The collection and actual network send are directly establi...