npm credential and data exfiltration reports.

This is not a passive connector: it combines remote terminal observation and prompt injection with default permission bypass and persistent changes to a broad AI-agent control surface. Th...

The package contains concrete runtime redirection of model traffic and embedded obfuscated credentials, not merely optional user-supplied networking. Its benign node-pty postinstall hook...

This is concrete, automatic install-time credential and data exfiltration to an attacker-controlled endpoint. The lifecycle hooks make the behavior execute without an explicit user command.

This package contains a concrete path that collects a local GitHub credential and transmits it to a hard-coded remote endpoint, plus default telemetry on every command. The lack of lifecy...

The code deliberately sends credential-bearing configuration to a remote logging endpoint unrelated to the required mail and Google APIs. Absence of an install hook does not mitigate this...

The source establishes a default runtime path that sends serialized credential-bearing account configuration to an unrelated remote logging endpoint. This is concrete credential exfiltrat...

The package contains an automatic external logging path that sends email-account data and broadly captured diagnostics to a third-party host. Its limited workspace-link install hook does...

Visible source establishes automatic external transmission of licence and exception data. This is concrete data exfiltration, independent of the opaque binary components.

Source inspection confirms credential collection and transmission of the raw GitHub token to a hard-coded non-GitHub endpoint. This is concrete credential-exfiltration behavior, despite b...

This is concrete, obfuscated payment-flow hijacking and external data transfer, even though it is not automatically run by npm installation. The missing declared entrypoint further sugges...

The package establishes a concrete default route from Codex requests to third-party endpoints and conceals a pool of provider credentials. Its limited native-build postinstall hook does n...

This is an unconsented postinstall modification of a consumer application's AI module combined with collection and remote transmission of sensitive AI interaction data. The guarded projec...

The source establishes a default, automatic exfiltration path to fixed third-party-controlled endpoints. The absence of an install hook does not remove the runtime disclosure risk.

The package automatically harvests raw agent session logs and routes them into cloud sync, while its telemetry bypasses personal opt-out for company-attributed activity. The guarded globa...

This is concrete unconsented install-time host data exfiltration to an external endpoint. The lifecycle trigger and callback are directly established by source inspection.

This is a concrete credential-harvesting payload automatically deployed into an auto-loaded agent skill path. The benign native-module rebuild postinstall hook does not neutralize the run...

The package contains a concrete runtime path that defaults to third-party webhooks and posts rich application records. Although it has no install hook, the embedded destination and automa...

The package contains a concrete default library path that transmits an API credential to an external remote execution service. The absence of install hooks and the safer CLI default do no...

Both published entry bundles contain a guarded but concrete third-party account-profile collection and upload path. The absence of an install hook does not neutralize this runtime data-ex...

The package embeds active third-party webhook endpoints as the default destination for rich runtime logs and transmits the serialized records automatically. This is concrete unconsented d...

The package explicitly reads locally available GitHub credentials and sends them to a hard-coded external endpoint. The lack of an install hook limits the trigger but does not remove the...