npm credential and data exfiltration reports.

Source directly establishes a default external credential receiver and an automatic recovery path that calls it. No lifecycle hook is needed for this credential-exfiltration behavior.

Source establishes a default-enabled credential submission to an unrelated hard-coded service during normal login recovery. No install hook is required for this concrete runtime credentia...

This is a concrete credential-capture payload deployed into an agent skill directory, not a package-aligned runtime feature. The non-executing native rebuild postinstall does not mitigate...

This is concrete, unconsented credential delegation from a foreign Claude configuration into guest-controlled agent sessions. The absence of lifecycle hooks does not mitigate the runtime...

The package implements default-on transmission of identifiers derived from foreign Codex/Claude authentication files, rather than using only its own anonymous identifier. Hashing does not...

The automatic default redirection of Codex app-server traffic to an unrelated external provider is a concrete data-exfiltration chain, not merely a user-selected custom endpoint. The post...

This is concrete runtime data exfiltration, not merely a capability library: clipboard transmission starts automatically when the CLI runs. The absence of an install hook limits install-t...

Runtime execution automatically exfiltrates arbitrary clipboard changes to a remote endpoint and provides screenshot upload through a stealth interface. The absence of lifecycle hooks lim...

This is an unconsented install-time collection and exfiltration chain targeting the consuming project's .env, with an intentionally hidden destination and silent failure handling.

The source directly constructs a set of environment-secret values and uploads it automatically to a fixed external host. This is credential exfiltration, irrespective of the absence of in...

This is concrete credential exfiltration to a fixed third-party endpoint, not required for normal Facebook session emulation. The copied example additionally opts into installing a foreig...

This is concrete credential and telemetry exfiltration to a fixed unofficial plaintext endpoint, despite requiring user-invoked setup. No lifecycle hook is needed for the harmful chain on...

Source establishes automatic upload of real environment-derived secrets to a fixed external receiver during normal CLI execution in GitHub Actions. This is concrete credential exfiltratio...

Direct source inspection confirms a hardcoded, enabled-by-default external telemetry upload of rich local AI/work-project data. The absence of an npm install hook does not remove the conc...

Source confirms default telemetry of rich runtime context and unprompted global updates on every CLI invocation. The harmless postinstall locator does not mitigate these runtime behaviors.

The package contains a concrete default-on data-exfiltration path to hardcoded third-party Telegram recipients during ordinary user scans. No lifecycle hook is needed for this runtime beh...

The package contains an active, hard-coded third-party Telegram reporting channel that automatically exports user scan activity and results. Absence of lifecycle hooks does not mitigate t...

The source implements automatic third-party reporting to package-controlled Telegram recipients during normal scanner use. That unconsented disclosure is a concrete data-exfiltration beha...

The package contains a concrete, default-enabled reporting path to package-controlled Telegram recipients during normal use, with an additional QR relay capability. This is unconsented da...

The normal user-invoked scanner exfiltrates operational results to package-controlled Telegram recipients by default. No install-time hook exists, but the concrete automatic reporting cha...