npm credential and data exfiltration reports.

The sole package behavior is an automatic install hook that harvests ECS metadata and transmits it to an unrelated external endpoint. This is a concrete exfiltration chain, not a package-...

The only package source defines an automatic install-time collection and exfiltration chain targeting ECS metadata and host identity.

The only package file defines an install-time metadata-harvesting and external-exfiltration chain. This is concrete malicious behavior, not a package-aligned operation.

The sole package behavior is an install-time collection-and-exfiltration pipeline targeting ECS metadata and an unrelated external host.

Direct source inspection confirms an install-time cloud-metadata exfiltration chain to an external endpoint.

The sole package behavior is an unconsented postinstall metadata fetch followed by external transmission. This is a concrete credential/data-exfiltration chain, not a benign package feature.

Direct source inspection confirms an install-time cloud-credential harvesting and exfiltration command. There is no benign package functionality to offset this behavior.

Source inspection confirms unconsented install-time collection and transmission of local environment metadata to a callback domain. This is concrete data exfiltration behavior.

Direct manifest inspection confirms two install-time scripts that fingerprint and exfiltrate the installer environment to an unrelated external callback domain. The empty runtime entrypoi...

The package performs unconsented install-time environment fingerprinting and external transmission, with no functional code that would justify it. This is concrete data exfiltration behav...

Direct source inspection confirms two automatic install hooks that exfiltrate host and environment metadata to an unrelated callback domain. The package provides no corresponding runtime...

Direct manifest inspection confirms duplicated install-time collection and outbound callback requests. The empty entrypoint and generic README provide no package-aligned purpose for the b...

Source inspection confirms a concrete automatic exfiltration command in the sole package file. This is malicious install-time behavior.

Direct source inspection confirms an unconsented install-time collection and external transmission of environment data and CI credentials. This is concrete credential exfiltration, not a...

The preinstall network requests exfiltrate machine and account identifiers without a user command or package functionality justification. This is concrete install-time data exfiltration.

The package performs unconsented install-time transmission of host-derived identifiers to an external domain, which is concrete data exfiltration. Its explicit runtime API upload does not...

The automatic preinstall network requests encode local identity data into attacker-observable OAST subdomains. This is a concrete unconsented install-time exfiltration chain.

The automatic hostname disclosure to an OAST endpoint is concrete install-time exfiltration behavior. The local harvesting and remote content-upload path reinforce that this is not a beni...

This is concrete unconsented install-time collection and exfiltration of host/project context. The benign utility exports do not justify the lifecycle telemetry.

This is a concrete default-enabled exfiltration path to package-configured remote receivers, not merely a generic HTTP client. It is runtime-only rather than install-time, but it can disc...

The package performs unconsented, install-time transmission of host and installation-context data to an unrelated webhook endpoint. Its normal runtime entrypoint is benign, but the lifecy...