npm credential and data exfiltration reports.

Direct source inspection found a deceptive, obfuscated redirect that forwards browser query parameters to a concealed endpoint. The absence of npm lifecycle hooks does not mitigate this r...

Source confirms default remote transmission of GitHub Actions identity credentials and runtime secrets to a package-controlled endpoint. The absence of install hooks does not remove this...

Direct source inspection confirms concrete credential/session theft and exfiltration behavior in index.js. The lack of lifecycle hooks limits automatic activation but does not negate the...

The payload implements concrete credential harvesting and exfiltration, not merely risky primitives. Lack of an install hook limits automatic activation but does not make the directly exe...

This is a concrete, default-enabled external logging/exfiltration path for rich host application data, not merely a generic HTTP capability. No installation hook is needed for the runtime...

The package’s install hook establishes background persistence and its control-plane code can transmit workspace artifacts to a hard-coded plaintext endpoint. This is a concrete malicious...

Direct inspection found a concrete, undocumented third-party callback mechanism in the shipped executable. No install hook is needed for the runtime data-exfiltration risk to activate.

The postinstall hook performs concrete, unconsented collection and external transmission of local machine/user metadata. The benign-looking runtime analytics code does not mitigate this i...

Direct source inspection confirms unconsented install-time transmission of local host identity data to an opaque endpoint. This is concrete data exfiltration, not merely a noisy static he...

The unconsented postinstall collection and remote transmission of local host/user/path data is concrete install-time exfiltration. The runtime SDK code does not mitigate that behavior.

Direct source inspection confirms unconsented install-time host-fingerprint exfiltration. This is concrete malicious behavior, not a package-aligned feature.

Direct source inspection confirms an automatic install-time credential-exfiltration chain with no package-aligned purpose.

The package implements unconsented install-time secret collection and external exfiltration. Its comments and error suppression do not alter the concrete behavior.

Direct source inspection confirms install-time credential collection and external exfiltration, unrelated to the claimed AMM contracts/ABIs package.

The credential storage and remote job channel are reachable during ordinary runtime and use a package-default endpoint, not an installer-owned configuration. This is concrete exfiltration...

Source establishes a concrete collection-and-upload chain for foreign AI-agent session/state data. No install hook reduces install-time impact but does not negate runtime exfiltration.

This is concrete cross-agent data collection and remote upload, not merely user-requested local command execution. The lack of install hooks limits installation impact but does not remove...

Direct inspection confirms an install-time credential/system-data exfiltration chain. This is concrete malicious behavior, not a scanner-only inference.

This is concrete, default-enabled exfiltration of full assistant sessions after ordinary login, contradicted by the package's privacy claim. The install hook itself is non-malicious.

Source confirms a concrete, default-enabled external data-exfiltration chain after installation. The configurable UI does not negate the unsafe preconfigured destination and interval.

The hardcoded, default-enabled external reporting endpoint plus collection of Claude and Git work metadata establishes concrete unconsented data exfiltration. This is not justified by an...