npm credential and data exfiltration reports.

The package contains a concealed import-time dropper and a decoded credential-stealing payload with persistence and network exfiltration. This is concrete malicious behavior unrelated to...

This is a concrete, concealed import-time credential theft and persistence chain, not ABI functionality or a scanner-only signal.

This is a concrete hidden import-time malware chain with persistence and credential exfiltration, unrelated to the package's advertised Ethereum helper functions.

This is concrete import-time data exfiltration, not a monitoring utility. The absence of lifecycle hooks does not mitigate execution through the package main entrypoint.

Direct source inspection confirms unconsented install-time host-data collection and external exfiltration. This is concrete malicious behavior, not a benign package capability.

The package contains an executable payload specifically designed to archive agent data and covertly transmit it through npm publishing. Absence of a lifecycle hook limits automatic activa...

The package contains a concrete, immediately executing credential/workspace archive exfiltration script using an obfuscated publishing token. The lack of a manifest entrypoint limits auto...

Although no lifecycle hook or import path triggers it automatically, the package contains a concrete credential/configuration theft and npm-upload mechanism. The source establishes malici...

Direct source inspection confirms unconsented install-time privileged account creation and credential/host exfiltration. This is concrete malicious behavior, not a scanner-only inference.

Direct source inspection confirms unconsented install-time system reconnaissance and external exfiltration with no legitimate package behavior. This is concrete malicious credential/syste...

This is concrete, unconsented install-time credential/system and local-file harvesting with remote exfiltration. The lifecycle trigger and hard-coded exfiltration endpoint establish malic...

Direct source inspection confirms unconsented install-time harvesting and exfiltration of project files and host metadata to a third-party Discord webhook. This is concrete credential/dat...

This is concrete import-time credential/environment and filesystem reconnaissance followed by unconsented external exfiltration. The absence of lifecycle hooks limits installation impact...

Direct source inspection confirms automatic collection of environment and host data followed by transmission to a third-party Discord webhook. The absence of npm lifecycle hooks does not...

This is concrete, automatic data collection and exfiltration from the package entrypoint, not a package-aligned Babel preset implementation. Absence of an install hook does not mitigate r...

This is concrete, obfuscated preinstall-time reconnaissance and exfiltration with no apparent package functionality. The lifecycle hook executes automatically during installation.

Direct source inspection confirms lifecycle-triggered host fingerprint exfiltration to an unrelated external endpoint. This is concrete malicious data collection, not a scanner-only infer...

Direct inspection confirms a credential-harvesting lifecycle payload with external exfiltration and no legitimate package implementation. This is concrete malicious behavior, not a scanne...

Direct inspection confirms concrete, unsolicited install-time collection and external exfiltration with no package-aligned functionality. This meets the blocking threshold for malicious b...

This is concrete unconsented install-time telemetry exfiltration, not merely a dormant capability. The inert runtime module does not mitigate the preinstall beacon.

Direct source inspection confirms automatic install-time execution and broad local-file exfiltration to attacker-controlled Discord webhooks. This is concrete malicious behavior, not mere...