npm credential and data exfiltration reports.

The package contains a concrete automatic install-time collection and outbound transmission of local system identifiers. This is malicious data exfiltration rather than ordinary package s...

The source establishes a default-enabled reporting loop that exports identifiable installation, host, path, and user-activity metadata to a hard-coded third-party endpoint. No install hoo...

The package contains an automatic preinstall hook that collects local host metadata and transmits it to a hard-coded third-party endpoint. This is concrete install-time data exfiltration.

The CLI unconditionally ships tool activity and other log lines to a package-controlled Loki host, with only partial secret redaction and no opt-out in the flush path. That is hidden runt...

The common client entry loads unpinned remote code and, by default, forwards the stored PeerTube bearer token, email, and username to a package-controlled host. A fixed admin password in...

The plugin is not limited to YouTube search: every visitor page loads publisher remote code and, by default, forwards the local PeerTube session token to the publisher host, while the ser...

The active entrypoint automatically collects and exports a persistent identifier, public IP address, and usage telemetry to third parties. This is a concrete data-exfiltration surface rat...

The active executable performs credential and local-file collection followed by a network send. Its npm command name makes the behavior especially likely to be triggered through command c...

The active entry point contains concealed remote AI proxying and hidden prompt injection, neither of which is disclosed by the minimal package metadata. Although it has no install hook, t...

The preinstall hook unconditionally exfiltrates hostname and username to a listener and suppresses errors, which is concrete install-time data collection. A loopback URL and bug-bounty wo...

Automatic install-time host-identifier transmission to an external IP is a concrete data-exfiltration behavior. The duplicated import-time request reinforces that this is active behavior...

The package contains a concrete preinstall data-collection and HTTP-send operation. Automatic execution during installation makes this malicious install-time behavior.

The package exports a local service credential to a fixed unrelated external recipient by default, which is concrete credential exfiltration. Embedded administrator credentials add a sepa...

The active entrypoint implements unsolicited browser credential and data collection followed by transmission to an unrelated external endpoint. This is concrete credential and data exfilt...

Automatic install hooks harvest credentials and phone home to an unrelated oast.site host, which is concrete install-time malware. The empty library entry and local-only comments do not r...

The install-triggered, obfuscated DNS request transmits host and project metadata to an unrelated external domain. This is concrete covert data exfiltration, not a normal design-system ru...

This is an active, obfuscated install-time metadata exfiltration path. It has no necessary relationship to a global-header component.

The published entrypoint automatically hooks every local DevTools page and sends captured page and editor text, with an embedded key, to a hardcoded third-party worker while certificate c...

The published entrypoint silently forwards checkout PII to a hardcoded third-party webhook after encrypting it for the package operator. Obfuscation and the analytics label conceal that c...

The package automatically exfiltrates host and CI metadata from its active configuration entrypoint to an unrelated endpoint. This is concrete malicious data collection rather than config...

The sole entrypoint sends machine identity to an unrelated oast.fun callback and contains no StoreKit functionality. That is concrete data exfiltration even though a variable typo and mod...