npm credential and data exfiltration reports.

Automatic install-time host-identifier transmission to an external IP is a concrete data-exfiltration behavior. The duplicated import-time request reinforces that this is active behavior...

The active entrypoint implements unsolicited browser credential and data collection followed by transmission to an unrelated external endpoint. This is concrete credential and data exfilt...

Automatic install hooks harvest credentials and phone home to an unrelated oast.site host, which is concrete install-time malware. The empty library entry and local-only comments do not r...

The install-triggered, obfuscated DNS request transmits host and project metadata to an unrelated external domain. This is concrete covert data exfiltration, not a normal design-system ru...

This is an active, obfuscated install-time metadata exfiltration path. It has no necessary relationship to a global-header component.

The published entrypoint automatically hooks every local DevTools page and sends captured page and editor text, with an embedded key, to a hardcoded third-party worker while certificate c...

The published entrypoint silently forwards checkout PII to a hardcoded third-party webhook after encrypting it for the package operator. Obfuscation and the analytics label conceal that c...

The package automatically exfiltrates host and CI metadata from its active configuration entrypoint to an unrelated endpoint. This is concrete malicious data collection rather than config...

The sole entrypoint sends machine identity to an unrelated oast.fun callback and contains no StoreKit functionality. That is concrete data exfiltration even though a variable typo and mod...

The package's only runtime behavior is an automatic request that sends the machine hostname and OS platform to an unrelated oast.fun callback. That is concrete import-time data exfiltrati...

The package has no product behavior beyond an install hook that phones home host identity to webhook.site. That unsolicited exfiltration on install is concrete attack behavior.

The automatic lifecycle hook combines credential harvesting, internal reconnaissance, service-data collection, and exfiltration to an unrelated hard-coded endpoint. This is concrete malic...

The only runtime file immediately redirects the browser to a package-chosen webhook.site URL with document.cookie appended, using split strings to hide the sink. That is active cookie exf...

An npm install script and the package entrypoint both run an obfuscated probe that encodes the username, hostname, and working-directory name into a DNS lookup for oob.algamil7x.xyz. That...

Install and import both execute an obfuscated DNS lookup that embeds local username, hostname, and project directory into a query for oob.algamil7x.xyz. That is concrete environment exfil...

The install script and package entry are wired to an obfuscated probe that DNS-resolves a hostname containing the username, hostname, and directory name to oob.algamil7x.xyz. That is inst...

The install hook and package entry load obfuscated code that DNS-exfiltrates host and directory identity to oob.algamil7x.xyz. The web-component exports do not account for that hidden loo...

The install entry unconditionally runs an obfuscated identity beacon to oob.algamil7x.xyz, which is unrelated to the GTM dataLayer API. Char-code hiding, swallowed errors, and a fake diag...

The install lifecycle loads obfuscated probe code that sends username, hostname, and directory labels through DNS to oob.algamil7x.xyz. That is install-time data exfiltration, independent...

This is an active install-time DNS exfiltration path, not a configuration registry function. The encoded implementation and external endpoint support malicious intent.

This is an automatic, obfuscated DNS exfiltration path unrelated to an ABI library. It activates both at install time and import time without consent.