npm credential and data exfiltration reports.

This is concrete, obfuscated install/import-time metadata exfiltration, unrelated to the advertised utility package. The generic network helper does not mitigate the malicious DNS beacon.

Concrete install-time, obfuscated host-fingerprint exfiltration is present and unrelated to the advertised utility package. This is malicious behavior, not a benign network helper.

The package is a concealed remote data-collection and input-automation tool unrelated to its stated system-binary configuration purpose. Although no install hook runs it automatically, ex...

Direct inspection confirms default runtime cookie exfiltration unrelated to icon rendering. No install hook is needed for this concrete malicious behavior.

Direct source inspection confirms runtime cookie exfiltration to external endpoints; no install hook is required for the malicious behavior.

Direct source inspection confirms an automatic preinstall hook performing local-file and host-data exfiltration to an external OAST endpoint. This is concrete malicious behavior, not mere...

This is concrete, unconsented install-time metadata exfiltration concealed by obfuscation, not a package-aligned utility feature.

This is concealed, automatic host-data exfiltration at install/import time, unrelated to the advertised utilities.

Concrete obfuscated host-metadata collection and DNS exfiltration run automatically at install and import. The exported utilities do not justify this hidden beacon.

Source directly implements unconsented install-time host-data collection and external exfiltration. This is concrete malicious behavior, not a package-aligned feature.

Direct source inspection confirms unconsented install-time collection and external exfiltration, unrelated to the package's stated player purpose.

Direct source inspection confirms deliberate, hard-coded exfiltration of credentials supplied by the package consumer. The lack of install hooks does not mitigate the malicious runtime be...

Direct source inspection confirms raw Discord-token disclosure to a hard-coded developer webhook. Absence of install hooks does not mitigate the concrete runtime credential-exfiltration p...

Source inspection confirms concrete, automatic exfiltration of a user-supplied credential to a hard-coded developer endpoint. No lifecycle hook is needed because the malicious behavior is...

Obfuscated network transmission of arbitrary caller input with no implemented validation is concrete malicious behavior. It is runtime-triggered rather than install-time, but warrants blo...

Source directly confirms unconsented install-time collection and exfiltration of local system data. This is concrete malicious behavior, not merely a suspicious primitive.

Direct source inspection confirms an unconsented preinstall data-harvesting and exfiltration chain. No legitimate package functionality is present.

Source inspection confirms an obfuscated, runtime-triggered collection-and-upload path for sensitive application data. The absence of install hooks does not mitigate this concrete exfiltr...

The package contains concrete, import-triggered command execution and exfiltration rather than a merely user-invoked administrative feature. Its stated research purpose does not remove th...

This is concrete credential and secret collection with remote synchronization, not a package-aligned encryption primitive. Absence of lifecycle hooks limits activation to consumer runtime...

Direct source inspection confirms concrete runtime cookie exfiltration under the guise of an icon component. The absence of install hooks does not mitigate this application-runtime attack.