npm credential and data exfiltration reports.

Source establishes concrete credential exfiltration to a hard-coded third-party endpoint during an ordinary documented authentication flow. Lack of an install hook does not mitigate this...

Source directly confirms transmission of environment-derived secret values to a hard-coded external package service. The absence of install hooks limits the trigger but does not remove th...

This is concrete credential collection and remote transmission through a bundled all-sites browser extension with a non-local default backend. The absence of an npm install hook limits ac...

This is a concrete, persistent data-exfiltration chain, not merely an AI-agent configuration feature. It activates after a user-selected install, but the subsequent collection and upload...

Direct source inspection confirms an unconsented background chain from normal agent launches to collection and upload of local conversation content. This is concrete data exfiltration, no...

This is concrete, unconsented exfiltration of sensitive local AI-agent conversation data, not merely a user-requested upload feature. The lack of npm install hooks does not mitigate the r...

Source confirms automatic, cross-agent conversation harvesting and remote upload during ordinary CLI use. The absence of install hooks does not mitigate this concrete runtime data-exfiltr...

Source establishes a concrete, reachable automatic exfiltration chain rather than merely a user-invoked upload feature. No install-time hook is present, but runtime collection and upload...

This is concrete credential exposure and a persistent author-controlled remote administration path, not merely a WhatsApp bot feature. The install hook is not the blocking behavior.

The package contains concrete, enabled-by-default transmission of rich application records to hardcoded external receivers. This is not install-time behavior, but it is a direct runtime d...

The forced newsletter follow is concrete, runtime-reachable account manipulation, and fixed-recipient Telegram reporting creates a conditional data-exfiltration path. These behaviors are...

Source inspection confirms a hard-coded third-party credential receiver in the normal runtime login path. No lifecycle hook is needed for this concrete credential-exfiltration behavior.

Source establishes a concrete default credential-exfiltration path to an endpoint unrelated to Facebook, activated by ordinary package use. No lifecycle hook is needed for the harmful beh...

The source establishes a concrete credential-exfiltration path to a package-controlled default datastore, not merely a legitimate user-selected backend. Shared-database job polling also g...

Source directly establishes a default external credential receiver and sends authentication material to it during normal login. No lifecycle hook is needed for this concrete runtime crede...

Source inspection confirms hard-coded third-party uploads of project files and system identity data, including config files that the CLI treats as credential-bearing. The postinstall scaf...

Concrete default-enabled runtime data exfiltration is present in source; the absence of an install hook does not mitigate it.

Runtime behavior establishes concrete credential exfiltration to a package-supplied remote datastore; it is not required for a local WhatsApp bot. The preinstall hook is unrelated and doe...

Direct source inspection confirms unconsented install-time collection and external transmission of local system data. This is concrete credential/system-data exfiltration behavior.

Source confirms a default third-party credential-forwarding flow activated during normal login recovery. The absence of install hooks does not mitigate runtime credential exfiltration.

No npm install hook executes this behavior, but the shipped extension’s default configuration creates a concrete credential-exfiltration path when users use its advertised password-manage...