npm credential and data exfiltration reports.

This is concrete install-time persistence, cross-tenant reconnaissance, remote exfiltration, and runtime-code modification. The research-oriented comments do not negate the implemented be...

This is concrete install-time persistence and data exfiltration, with conditional cross-build dependency mutation. The package's research framing and sandbox guard do not make these actio...

A narrow guard does not make unconsented install-time reconnaissance acceptable in the environment it targets. The lifecycle-triggered collection and external callback establish concrete...

A hardcoded non-package endpoint receives automatically collected work and Claude-session data by default. The absence of an npm lifecycle hook does not remove the concrete post-install e...

This is concrete, automatic install-time credential and host-data exfiltration to an unrelated fixed endpoint. The behavior is not required by the package’s placeholder runtime library.

Direct manifest inspection confirms an automatic preinstall hook that exfiltrates the complete process environment to an unrelated external webhook. This is concrete malicious install-tim...

Source directly shows silent remote transmission of account configuration, including a serialized IMAP object, to a non-provider logging endpoint. The package's benign workspace postinsta...

Source confirms a default third-party credential receiver in the standard runtime login path. Absence of install hooks does not mitigate this concrete credential-exfiltration behavior.

The package's stated placeholder purpose does not require automatic external telemetry. Its postinstall beacon exfiltrates host-derived data through both HTTPS and DNS.

Source establishes a concrete default-enabled collection-and-exfiltration chain to a package-controlled public endpoint after plugin activation. The absence of an npm install hook does no...

Source establishes a concrete, default-enabled background exfiltration chain to a hardcoded public receiver. Absence of an npm lifecycle hook does not remove the risk once the explicit in...

The package contains a concrete, default-enabled external upload of environment secrets during GitHub Actions runtime. Absence of install hooks lowers lifecycle risk but does not remove t...

Source establishes an automatic, concealed third-party transfer of inbound photo attachments during normal chat-listening operation. The absence of install hooks does not mitigate this ru...

The source establishes a fixed default receiver, serializes secret values into a PUT request, and invokes that upload automatically in GitHub Actions. Absence of lifecycle hooks does not...

The concealed post-verification redirect and wholesale query forwarding are concrete browser-side attack behavior, not package-aligned functionality. It does not execute during npm instal...

Hardcoded default webhook destinations combined with automatic rich runtime logging form a concrete exfiltration chain. The absence of install hooks does not mitigate this application-run...

The source establishes unconsented install-time host fingerprint exfiltration and system mutation, not merely dormant capability. The telemetry endpoint is identifiable, but that does not...

Source inspection confirms a deliberately obfuscated, unconditional browser redirect that forwards query parameters after a deceptive verification screen. The absence of install hooks lim...

The package embeds active third-party webhook credentials and transmits broad runtime records to them by default. The absence of an install hook does not mitigate this runtime exfiltratio...

Direct source inspection confirms an install-time metadata collection and external exfiltration chain. The package has no other source files establishing a legitimate package function.

The sole package behavior is an install-time cloud-metadata collection and external transmission chain, with no package functionality to justify it.