npm credential and data exfiltration reports.

The primary entrypoint performs an unconditional network beacon containing local host and user metadata to a third-party endpoint. This is concrete data exfiltration, even though the brok...

Automatic install hooks exfiltrate host and username data to an unrelated external endpoint. The behavior is concrete and active, so the package should be blocked.

The package has a concrete automatic postinstall exfiltration path to an unrelated webhook endpoint. The collected host and user metadata is sent without user interaction or package-align...

The package has an automatic postinstall beacon that exfiltrates local system and project metadata to a third-party endpoint. This is concrete malicious install-time data collection.

This is concrete, automatic install-time credential and system-data exfiltration to an unrelated Telegram endpoint. The package should be blocked.

The package performs automatic install-time host and environment reconnaissance followed by external transmission. Its research labeling does not establish consent for this behavior.

This is concrete, unconsented install-time data exfiltration with redundant network channels. The package's research label does not neutralize the automatic behavior.

The automatic lifecycle hooks activate host and environment reconnaissance and transmit the results to an unrelated external Telegram recipient. The behavior is concrete install-time data...

This is concrete install-time host reconnaissance and outbound exfiltration to an unrelated Telegram recipient. The automatic lifecycle hook makes the behavior unconsented.

The source implements stealth, watchdog persistence, foreground capture, and external submission as one active workflow. Although installation itself does not activate the launcher, the c...

This is concealed, automatic host-data exfiltration through DNS during installation, unrelated to the stated Solana library function. The behavior is concrete malicious install-time data...

Automatic lifecycle execution collects sensitive local and build-environment data and sends it to unrelated external hosts. This is concrete malicious install-time exfiltration.

The sole published entrypoint contains direct browser-cookie exfiltration to an unrelated webhook endpoint. This is concrete malicious behavior rather than a package-aligned client request.

The package's only executable entrypoint contains direct cookie collection and transmission to an unrelated third-party endpoint. This is concrete credential exfiltration behavior.

The cheerleading metadata is cover: the ESM entry and extra source files execute obfuscated load-time code that overlays a fake Stripe payment iframe on checkout pages. That is a concrete...

The only shipped behavior is an automatic postinstall that reads /tmp/flag.txt and sends it to an attacker-controlled ngrok URL. That is unconsented install-time data theft, not a develop...

The published main entrypoint is a default-on harvester that sends cookies and scraped application flags to a hardcoded webhook.site URL. That is concrete exfiltration, so the package is...

The package contains concrete import-time collection and external transmission of browser cookie and profile data. The absence of lifecycle hooks does not mitigate this runtime exfiltrati...

The package's sole entry contains direct authenticated data collection and third-party exfiltration. Absence of an install hook does not mitigate the import-time browser attack.

Source inspection confirms automatic credential and application-data collection with exfiltration to a fixed third-party endpoint. The lack of install hooks does not mitigate the maliciou...

This is concrete, automatic credential and application-data exfiltration from the package entry point. The fixed external receiver and immediate execution establish malicious behavior.