npm credential and data exfiltration reports.

Source inspection confirms an install lifecycle script that exfiltrates CI/build identifiers and hostname to an external callback, so this is not merely a scanner false positive. The limi...

Direct source inspection confirms import-time credential/environment harvesting and external exfiltration with no user consent or package-aligned purpose. This is concrete malicious behav...

Read-only source inspection confirmed package.json contains the only executable behavior: an install lifecycle hook that sends installer identity and environment context to an unrelated e...

Source inspection confirms concrete install-time network exfiltration to a hardcoded Sentry DSN via package.json preinstall and examples/verify.js. This is unconsented lifecycle execution...

The package contains legitimate-looking Sentry helpers, but package installation automatically sends data to a hardcoded Sentry project and resolves/attaches the installer's public IP. Th...

Source inspection confirms unconsented install-time network telemetry to a hardcoded Sentry project plus public IP collection. Although the package exposes a plausible logging API, execut...

The inspected source confirms unconsented install-time collection and exfiltration of environment and host metadata to external endpoints. The declared security-research PoC purpose does...

Source inspection confirms an install-time obfuscated script that transmits the full environment, creating a concrete credential-exfiltration risk. The behavior is not package-aligned tel...

Source inspection confirms automatic install-time collection and outbound transmission of process.env, which can contain credentials and is not necessary for a dotenv-style package. The p...

Source inspection confirms concrete runtime exfiltration of process.env to an unrelated endpoint in both TypeScript source and published dist entrypoints. The lifecycle scripts are noisy...

Runtime Sentry reporting can be package-aligned, but executing it automatically from preinstall with a hardcoded DSN and public-IP collection creates concrete unconsented install-time dat...

Direct source inspection confirms unconsented install-time collection and outbound exfiltration of host, CI, and credential-like environment data. The empty runtime entrypoint does not mi...

Direct source inspection confirms unconsented install-time host and credential-like environment collection with outbound HTTP and DNS callbacks. This is concrete malicious behavior despit...

Read-only source inspection confirms unconsented install-time collection and outbound transmission of credential-like environment variables and host identifiers. This is concrete maliciou...

Direct source inspection confirms unconsented install-time collection and exfiltration of credential-like environment data to non-package-aligned endpoints. Benign index.js and README.md...

Direct source inspection confirms concrete install-time exfiltration behavior with external network transmission and no package-aligned benign purpose. This should be blocked from publica...

Source inspection confirms repeated install-time credential/secret harvesting, external exfiltration, and unauthorized local API mutation with no package-aligned purpose. This is concrete...

Direct source inspection confirms install-time secret harvesting, external exfiltration, and local API mutation attempts in all lifecycle scripts. This is concrete malicious behavior with...

Source inspection confirms concrete data exfiltration behavior unrelated to an ESLint helper: sensitive file patterns are recursively collected from the caller's cwd and posted to a conce...

Direct source inspection confirms an install-time network callback that fingerprints and exfiltrates local user and host details. The behavior is unrelated to package functionality and is...

Source inspection confirms coordinated install-time data staging and import-time obfuscated network exfiltration. The behavior is unconsented and unrelated to legitimate Electron runtime...