npm credential and data exfiltration reports.

Source confirms a covert, persistent-on-use path that uploads foreign AI-agent conversation data to a remote backend. The absence of install hooks does not mitigate this concrete unprompt...

Direct source inspection confirms a documented consent gate that is bypassed for headless execution while telemetry remains enabled and sends identifiable Salesforce metadata. This is con...

Direct source inspection confirms credential disclosure to a third-party endpoint, not merely a scanner heuristic. The lifecycle hook is benign, but it does not mitigate the credential-ex...

Source establishes automatic, remote transmission of user content and local operational data after MCP startup. This is concrete data exfiltration, not merely package-aligned network use.

This is concrete, unconsented install-time execution of an obfuscated credential-stealing payload; the Bun bootstrap is used to ensure it runs. The legitimate-looking CI orb content does...

This behavior is unrelated to a Babel preset and is activated automatically at install time. The clear launcher-to-obfuscated-payload chain establishes concrete malicious behavior.

Direct inspection confirms an install-time bootstrapper executing an obfuscated credential-oriented remote payload. This is concrete malicious supply-chain behavior, not a legitimate conf...

Source inspection confirms an automatic preinstall chain into an obfuscated payload with credential-oriented logic and remote eval. This is concrete malicious behavior, not a benign build...

The shipped, startup-seeded token-harvesting skill is concrete credential-capture behavior, not a benign network primitive. Lack of automatic invocation reduces reach but does not remove...

Source confirms credential harvesting from third-party application stores, automatic reachability from the main apply path, persistence, and use in gateway-routed traffic. The absence of...

Concrete install-time execution leads to an obfuscated payload with credential collection and upload behavior. The benign example sources do not justify this installer chain.

Source inspection confirms a concrete install-time bootstrapper for an obfuscated credential-harvesting/exfiltration payload. This is malicious behavior, not a package-aligned build depen...

This is not package-aligned SDK behavior: a preinstall bootstrap executes a concealed payload with remote eval and credential-oriented code. The concrete install-time execution chain warr...

Concrete preinstall execution of an obfuscated remote-code payload with credential-harvesting logic establishes malicious behavior. The normal-looking SDK bundle does not mitigate the ins...

This is concrete, unconsented preinstall execution of an obfuscated credential-harvesting payload, not functionality aligned with a React web SDK.

This is concrete malicious install-time behavior, not package-aligned SDK functionality. The payload is automatically executed by preinstall and contains both credential collection and re...

Direct source inspection confirms an install-triggered downloader/executor feeding an obfuscated script with remote eval and credential handling. This is concrete malicious behavior, not...

This behavior is unrelated to a React web SDK and is automatically triggered before installation completes. The obfuscated remote-eval payload establishes a concrete malicious chain.

This is not package-aligned SDK behavior: the install hook bootstraps an unpinned executable to run obfuscated code that evaluates fetched content and targets credentials. The concrete pr...

This is concrete install-time execution of an obfuscated credential-oriented remote-code payload, not functionality aligned with a React component library.

The lifecycle execution, downloaded interpreter, obfuscated payload, remote eval, and credential logic form a concrete malicious chain unrelated to documentation delivery.