npm credential and data exfiltration reports.

Direct source inspection confirms install-time credential harvesting and exfiltration behavior in postinstall.js, with no relationship to the advertised date formatting functionality. Thi...

Direct source inspection confirms concrete install-time credential harvesting, host/container reconnaissance, and exfiltration behavior unrelated to package functionality. This warrants b...

Source inspection confirms unconsented install-time data staging plus obfuscated import-time network transmission logic unrelated to a legitimate Electron runtime helper. This is concrete...

Direct source inspection confirms unconsented install-time host reconnaissance and outbound exfiltration behavior in postinstall.js, with no package-aligned reason for metadata probing or...

Direct source inspection confirms install-time machine/user fingerprint exfiltration to an external domain, which is not package-aligned for a lightweight date utility. The benign runtime...

Direct source inspection confirms unconsented install-time reconnaissance and exfiltration to a hard-coded external endpoint. The benign main library does not justify the lifecycle hook b...

Source inspection confirms concrete install-time credential and environment exfiltration unrelated to the package's date utility purpose. The package should be blocked.

The lifecycle hook performs concrete unconsented data exfiltration to an external callback domain, using multiple fallback network tools. The benign date formatting entrypoint does not ju...

Direct source inspection confirms unconsented install-time collection and external exfiltration of local environment data. This is concrete malicious behavior rather than package-aligned...

Static source inspection confirms a concrete, unconsented process.env exfiltration path in both TypeScript source and published dist code. The sports scraping behavior is package-aligned,...

The package’s primary behavior is browser credential harvesting/decryption, with obfuscation and a native debug-elevator addon increasing risk beyond ordinary package-aligned functionalit...

Direct source inspection confirms reachable install-time exfiltration behavior with child_process, filesystem reads, and outbound network requests. This has no package-aligned purpose and...

Source and string inspection confirms a purpose-built browser credential harvesting capability, not merely benign package functionality. Even without install-time execution or observed ex...