npm credential and data exfiltration reports.

Source inspection confirms malicious runtime behavior behind the package’s exported date parser. Lack of lifecycle hooks limits installation-time exposure but does not mitigate the activa...

The normal entrypoint is inert, but the intentionally deceptive export activates import-time persistence of a handler designed to harvest sensitive host files. No lifecycle hook is requir...

This is concrete secret-harvesting and application-file mutation hidden behind a deceptive export, despite lacking an install hook or direct network call.

Direct source inspection confirms automatic postinstall execution and outbound transmission of host-identifying data to an attacker-controlled callback endpoint.

The package contains a concrete, automatic, non-package-aligned host-fingerprinting exfiltration chain at install time. The normal SDK entrypoint does not justify this hidden telemetry.

This is concrete, unconsented install-time reconnaissance and exfiltration unrelated to the advertised GraphQL generator.

Concrete postinstall credential collection and transmission are present in source. The package should be blocked.

The postinstall hook contains concrete, unconsented command execution and credential-related environment harvesting with network forwarding. The benign runtime export does not mitigate th...

This is concrete, obfuscated install/import-time metadata exfiltration, unrelated to the advertised utility package. The generic network helper does not mitigate the malicious DNS beacon.

Concrete install-time, obfuscated host-fingerprint exfiltration is present and unrelated to the advertised utility package. This is malicious behavior, not a benign network helper.

The package is a concealed remote data-collection and input-automation tool unrelated to its stated system-binary configuration purpose. Although no install hook runs it automatically, ex...

Direct inspection confirms default runtime cookie exfiltration unrelated to icon rendering. No install hook is needed for this concrete malicious behavior.

Direct source inspection confirms runtime cookie exfiltration to external endpoints; no install hook is required for the malicious behavior.

Direct source inspection confirms an automatic preinstall hook performing local-file and host-data exfiltration to an external OAST endpoint. This is concrete malicious behavior, not mere...

This is concrete, unconsented install-time metadata exfiltration concealed by obfuscation, not a package-aligned utility feature.

This is concealed, automatic host-data exfiltration at install/import time, unrelated to the advertised utilities.

Concrete obfuscated host-metadata collection and DNS exfiltration run automatically at install and import. The exported utilities do not justify this hidden beacon.

Source directly implements unconsented install-time host-data collection and external exfiltration. This is concrete malicious behavior, not a package-aligned feature.

Direct source inspection confirms unconsented install-time collection and external exfiltration, unrelated to the package's stated player purpose.

Direct source inspection confirms deliberate, hard-coded exfiltration of credentials supplied by the package consumer. The lack of install hooks does not mitigate the malicious runtime be...

Direct source inspection confirms raw Discord-token disclosure to a hard-coded developer webhook. Absence of install hooks does not mitigate the concrete runtime credential-exfiltration p...