npm credential and data exfiltration reports.

The package contains an automatic install hook with concrete secret disclosure and filesystem persistence. The absence of network code does not remove the install-time credential-harvesti...

This is a concrete, unconsented postinstall secret-exfiltration chain, not a package-aligned configuration helper.

Source directly confirms an install-time dependency-confusion payload that exfiltrates host metadata to an attacker-controlled endpoint. Its stated research purpose does not remove the co...

This is concrete, unconsented preinstall-time data exfiltration through multiple external channels. The package has no legitimate runtime function beyond the beacon.

This is not a normal icon/SVG package: it deploys a persistent browser proxy and forwards session cookies through its transport. The absence of npm lifecycle hooks limits install-time imp...

The source intentionally conceals a default endpoint inconsistent with its documented branding and transmits caller data plus authorization to it. This establishes malicious credential an...

Intentional endpoint concealment plus a runtime mismatch with advertised service metadata creates a concrete credential-and-prompt exfiltration path. It is user-call-triggered, but the de...

This is concrete, unconsented preinstall-time host and project metadata exfiltration to a fixed third-party callback. A stated research purpose does not remove the install-time disclosure.

The source implements automatic preinstall-time collection and external transmission of identifying host and project data. Its stated research intent does not remove the concrete unconsen...

The package executes automatically during installation and exports identifiable host, network, path, and project metadata to a fixed third-party callback. Its stated research purpose does...

Direct source inspection confirms automatic preinstall execution and multiple outbound channels carrying collected host and consumer-project metadata. The declared dependency-confusion Po...

The package implements a concrete credential-exfiltration chain to a hard-coded third-party endpoint, including an automatic configured-credential path. Absence of install hooks does not...

This is concrete default runtime data exfiltration to embedded third-party webhook recipients, not an inert networking primitive. The absence of an install hook limits the trigger to use...

Direct source inspection confirms a reachable preinstall reconnaissance and data-exfiltration chain. This is concrete unconsented install-time behavior, independent of the package's state...

The package delivers an obfuscated tracking/proxy application under an SVG package identity and activates it on rendering. Its concealed fingerprinted requests create a concrete data-exfi...

The package automatically performs broad host and project metadata collection during preinstall and exfiltrates it to a third-party callback. Its stated research purpose does not provide...

The package performs concrete, unconsented install-time collection and external exfiltration of system and project data. Its stated research purpose does not remove the active data-exfilt...

This is concrete, unconsented install-time reconnaissance and exfiltration from the consuming environment. Research-oriented labels do not remove the external data-transfer attack surface.

This is concrete unconsented preinstall-time data exfiltration from the consuming environment through multiple external channels. The absence of credential theft or persistence does not m...

The package's advertised TOTP code is coupled to concrete credential theft, remote exfiltration, and unsolicited payload installation. These behaviors execute automatically at install tim...

This is concrete, unconsented install-time metadata exfiltration, regardless of its claimed research purpose. The DNS encoding and redundant callback channels make the behavior an active...