npm credential and data exfiltration reports.

The package's active main entrypoint automatically collects sensitive cloud and local secrets and transmits them to an unrelated external endpoint. This is concrete malicious data exfiltr...

The active import-time entry point harvests credentials and sensitive runtime data and exfiltrates it to an unrelated external host. This is concrete credential and data exfiltration beha...

Active import-time collection and export of cloud credentials, environment variables, and Kubernetes secrets is concrete malicious behavior. The absence of an install hook does not reduce...

The active entrypoint implements unconsented credential and secret collection followed by transmission to an unrelated hard-coded endpoint. This is concrete data exfiltration behavior.

The active entrypoint implements automatic secret collection and export to an unrelated external host. This is concrete credential and data exfiltration.

The active entrypoint contains automatic harvesting and outbound transmission of credentials and secrets to an unrelated external endpoint. This is concrete malicious behavior.

The entrypoint contains an automatic, concrete secret-harvesting and external transmission chain. The absence of an install hook does not remove the import-time exfiltration behavior.

The active entrypoint implements unconsented credential and secret collection followed by external transmission. This is concrete data exfiltration, not a dormant capability.

The package contains an active, automatic secret-harvesting and external-exfiltration routine in its main entrypoint. The absence of an install hook does not mitigate execution when the p...

Active import-time collection and export of cloud and local secrets is concrete credential exfiltration. The package should be blocked.

The active entry point automatically harvests sensitive cloud and local secret material and sends it to an unrelated external endpoint. This is concrete malicious credential and data exfi...

The package contains active automatic collection and external transmission of cloud credentials and local secrets. This is concrete credential and data exfiltration behavior.

This is active, import-triggered secret harvesting and exfiltration to an unrelated fixed endpoint. The behavior is concrete and requires blocking publication.

This is concrete automatic credential harvesting and data exfiltration during installation, concealed by heavy obfuscation. It is unrelated to a legitimate dotenv preflight check.

The browser entrypoint contains deliberately obfuscated remote-configured redirect logic rather than a legitimate package function. Its active forwarding of visitor URL parameters to a re...

The active import-time server and concealed remote credentialed client are incompatible with the minimal package identity and create concrete unconsented forwarding of user input. The lac...

The package has no install lifecycle hook, but its normal runtime automatically exports host and usage telemetry to an external default recipient and accepts server-directed endpoint chan...

The active, obfuscated remote redirect chain and forwarding of visitor query parameters establish a concrete malicious browser payload. The code provides no source-visible destination all...

Automatic execution of an obfuscated payload that collects and transmits IP and location data through an authenticated account is concrete data exfiltration. The absence of an install hoo...

The package contains an active path that defaults a user-facing feature to package-embedded external webhooks and transmits its log records there. The absence of an install hook does not...

The package contains an automatic install hook connected to active credential harvesting and outbound transmission. This is concrete malicious data exfiltration.