npm credential and data exfiltration reports.

This is a concrete install-time credential-stealing and payload-dropping chain unrelated to TOTP functionality. The delayed, swallowed-error postinstall increases stealth.

Source confirms automatic preinstall execution and external transmission of identifying host and project data. The stated research purpose does not remove the concrete unconsented exfiltr...

This is concrete install-time credential theft and unauthorized payload installation, unrelated to TOTP utilities. The legitimate TOTP API is a cover and also triggers the malicious routine.

This is concrete credential forwarding to an undisclosed third-party endpoint, not merely an unused dependency or generic network capability. Although it is UI-triggered rather than insta...

Source confirms credential and environment transmission to a hard-coded external endpoint during the default enabled execution feature. There is no lifecycle persistence, but the concrete...

The package intentionally routes wallet recovery phrases to an external endpoint through a benign-looking UI control. This is concrete secret exfiltration despite the absence of install-t...

The explicit confirmation and lack of an npm install hook reduce stealth, but the bundled all-sites credential collector defaults to an unrelated external endpoint and constitutes a concr...

The hard-coded third-party authentication endpoint receives raw user credentials at runtime, which is not required for a local Facebook API client. No install hook is needed for this conc...

The package performs destructive mutations and fingerprint telemetry during postinstall. The global-install gate does not make deletion of potentially unrelated binaries or device trackin...

The package embeds a default external logging route that transmits normal runtime records, including raw scan input, without an explicit caller-provided endpoint. This is concrete data ex...

Source establishes credential exfiltration to a hard-coded non-Facebook endpoint, including an automatic recovery trigger. No lifecycle hook is needed for this concrete runtime attack.

Source inspection confirms unsolicited import-time networking and a public helper that exfiltrates caller-supplied phone numbers to an unrelated host. The install hook itself is benign, b...

Source inspection confirms a runtime credential-exfiltration path to a hard-coded third-party endpoint during ordinary login. No install hook is needed for this concrete malicious behavior.

This is concrete, stealth-oriented install-time credential and data exfiltration with no legitimate functional purpose. Block publication.

This is concrete credential exfiltration from foreign agent configuration to a package-controlled endpoint before consent, not merely an explicit configuration helper.

The package silently sends mail-account configuration to an unrelated endpoint during ordinary initialization. No lifecycle hook was found, but the concrete runtime exfiltration warrants...

Direct source inspection confirms a cookie-forwarding service-worker proxy bundled under an unrelated SVG package name. The absence of install hooks limits install-time impact but does no...

This is concrete install-time credential and data exfiltration with stealth/anti-analysis behavior, not package-aligned functionality. The package should be blocked.

The package embeds a default third-party login relay and automatically invokes it for configured credentials during session recovery. This is concrete credential exfiltration behavior, de...

Source confirms a default third-party credential receiver and reachable runtime paths that transmit supplied Facebook secrets. Absence of lifecycle hooks does not mitigate this credential...

The package contains a concrete runtime path that serializes potentially password-bearing IMAP settings and sends them to an unrelated remote log endpoint. Lack of lifecycle hooks does no...