npm credential and data exfiltration reports.

Inspected source establishes automatic system reconnaissance and data exfiltration unrelated to CSS polyfill functionality. The registry payload is executable on load, despite the absence...

Inspected source proves automatic system-data exfiltration upon loading the published registry module, unrelated to CSS field sizing. The payload is executable attack code, although ordin...

Inspected source establishes automatic host-data collection and transmission upon registry-module loading. The empty default entrypoint limits activation but does not neutralize the execu...

Inspected source proves automatic host-data collection and transmission in a distributed registry module. This is concrete data exfiltration, despite the absence of install hooks and the...

Inspected source implements concrete data collection and transmission unrelated to accessibility management. The attack activates when the registry asset is evaluated, despite the absence...

Inspected source demonstrates automatic external transmission of host and user information unrelated to CSS utilities. The inert default entrypoint limits activation but does not neutrali...

The source establishes automatic, unconsented disclosure of local environment information to an external recipient. Research labels do not neutralize the active exfiltration behavior.

The active preinstall hook performs unconsented environment-data exfiltration unrelated to the package's runtime functionality. The collection and actual network send are directly establi...

The source establishes automatic, unconsented export of identifying installation data unrelated to the package's color-generation functionality. This supports blocking for data exfiltrati...

The source establishes automatic, unconsented transmission of identifying local information to an unrelated external recipient. This concrete installation-time data exfiltration warrants...

The inspected source establishes automatic, unconsented export of local identifying information unrelated to the package's functionality. The active collection and network send support a...

The source establishes automatic, unconsented transmission of local identifying information to an unrelated endpoint during installation. This is concrete data exfiltration rather than an...

The automatic lifecycle performs concrete, unconsented data exfiltration unrelated to the package's date-formatting functionality. The collection and actual network send are directly esta...

Source proves automatic, unconsented export of identifying local information during installation. The external reporting behavior is unrelated to the package’s arithmetic functionality an...

The source proves automatic, unconsented export of local identifying information to an unrelated external recipient. This concrete install-time data exfiltration warrants blocking.

The source establishes automatic collection and external transmission of identifying local information during installation. This concrete data exfiltration supports blocking the package.

The install-time hook, broad secret collection, obfuscation, and outbound submission form a concrete credential-exfiltration chain. The hidden recipient prevents any legitimate destinatio...

The package implements automatic secret harvesting and outbound transfer during installation. This is concrete credential and data exfiltration behavior.

The postinstall hook activates obfuscated filesystem harvesting and outbound upload of secret-bearing data. This is concrete malicious credential exfiltration.

This is active, automatic credential and secret exfiltration from the package entrypoint. The behavior is unrelated to account management and has a concrete external transmission sink.

This is active, automatic credential and secret harvesting followed by transfer to an unrelated external endpoint. The behavior is concrete data theft, not a package-aligned capability.