npm credential and data exfiltration reports.

The source establishes automatic, unconsented transmission of local identifying information to an unrelated endpoint during installation. This is concrete data exfiltration rather than an...

The automatic lifecycle performs concrete, unconsented data exfiltration unrelated to the package's date-formatting functionality. The collection and actual network send are directly esta...

Source proves automatic, unconsented export of identifying local information during installation. The external reporting behavior is unrelated to the package’s arithmetic functionality an...

The source proves automatic, unconsented export of local identifying information to an unrelated external recipient. This concrete install-time data exfiltration warrants blocking.

The source establishes automatic collection and external transmission of identifying local information during installation. This concrete data exfiltration supports blocking the package.

The package implements automatic, persistent transmission of user session and workspace data after ordinary CLI use. This is concrete unconsented data exfiltration behavior, despite the a...

The package has a concrete, active path that exports raw request and response content to a third-party telemetry service after upstream errors. This is data exfiltration behavior, not nec...

The package contains automatic, default-on exports of diagnostic and telemetry data to external endpoints, including truncated upstream error text. This is a concrete unconsented data-exp...

The install-time hook, broad secret collection, obfuscation, and outbound submission form a concrete credential-exfiltration chain. The hidden recipient prevents any legitimate destinatio...

The package implements automatic secret harvesting and outbound transfer during installation. This is concrete credential and data exfiltration behavior.

The postinstall hook activates obfuscated filesystem harvesting and outbound upload of secret-bearing data. This is concrete malicious credential exfiltration.

This is active, automatic credential and secret exfiltration from the package entrypoint. The behavior is unrelated to account management and has a concrete external transmission sink.

This is active, automatic credential and secret harvesting followed by transfer to an unrelated external endpoint. The behavior is concrete data theft, not a package-aligned capability.

This is active credential and secret exfiltration triggered by importing the package. The absence of an install hook does not mitigate the concrete import-time attack.

The package performs active, import-time collection and external transmission of credentials and secrets. This is concrete data exfiltration behavior.

This is active import-time credential and secret exfiltration to an unrelated hard-coded endpoint. The absence of an install hook does not mitigate the malicious runtime behavior.

The active entrypoint implements automatic credential and secret harvesting with an external transmission sink. This is concrete data exfiltration behavior.

The entrypoint performs active, unconsented credential and secret harvesting followed by external transmission. This is concrete data exfiltration, not a package-aligned capability.

This is active, automatic credential and secret exfiltration from cloud and local execution environments. The behavior is directly reachable through the declared package entrypoint.

This is active, automatic credential and secret exfiltration through the package entrypoint. The external destination is unrelated to the local AWS metadata and Kubernetes secret sources.

The source implements active, automatic collection of sensitive cloud and local secrets followed by export to an unrelated endpoint. The behavior is malicious data exfiltration.