npm credential and data exfiltration reports.

The install hook executes a concealed, unrelated payload with remote eval and GitHub-token handling; this is concrete malicious behavior, not package-aligned setup.

This is concrete install-time staged execution followed by credential-harvesting behavior, not a package-aligned build step. The benign component source does not justify the hidden preins...

This is concrete unconsented install-time credential theft and remote code execution, not a package-aligned build step. The visible theme code does not justify the concealed preinstall ch...

The concealed preinstall chain executes an obfuscated token-oriented payload and is concrete malicious behavior. The visible UI source does not justify this install-time functionality.

The preinstall chain executes a concealed payload rather than package functionality, with remote eval and token handling. This is concrete malicious install-time behavior.

The package has an unconsented preinstall chain that bootstraps a runtime solely to execute a large obfuscated, credential/network-capable payload. This is concrete malicious install-time...

The lifecycle chain concretely executes a concealed credential-oriented network payload at install time. Its behavior is unrelated to the package’s stated library functionality.

This is concrete unconsented install-time execution, not an application-aligned dependency helper. The obfuscated payload's credential collection, exfiltration flow, and remote eval estab...

The malicious preinstall chain executes an obfuscated payload with credential-oriented and network behavior. The legitimate bundled component code does not justify it.

Source inspection confirms a concealed, dynamically evaluated payload executed automatically at install time, with GitHub credential-token handling. This is concrete malicious behavior, n...

The lifecycle hook is unrelated to a React UI library and deliberately stages an obfuscated payload. Direct source inspection confirms credential collection and remote content evaluation.

The concealed preinstall downloader/executor is unrelated to the package’s stated functionality, and the executed payload includes credential-token handling. This is a concrete install-ti...

The preinstall hook stages and runs an obfuscated payload unrelated to this React library, with concrete GitHub-token collection and network-upload behavior. This is malicious install-tim...

This is an unconsented install-time staged payload with concrete credential-harvesting and network-exfiltration behavior. The benign library build does not mitigate the preinstall attack...

This is concrete unconsented install-time execution of an obfuscated credential-collection payload, not behavior needed by the published UI library. Block publication.

This is concrete unconsented preinstall execution of a concealed payload, not a package-aligned build step. The visible library code does not justify its downloader, runtime bootstrap, or...

This is concrete install-time execution of an obfuscated credential-harvesting and network-exfiltration payload. The harmless runtime loader is distinct from the preinstall chain.

The UI distribution appears benign, but its install hook deliberately bootstraps and executes an unrelated obfuscated credential-capable payload. This is concrete malicious behavior, not...

Concrete install-time execution, remote binary bootstrapping, and an obfuscated token/network payload establish malicious behavior. The normal UI build does not mitigate the preinstall at...

Concrete install-time execution of an unrelated obfuscated payload with remote eval and credential-oriented logic is malicious. The benign library implementation does not justify the payl...

This is concrete, unconsented install-time execution of an obfuscated credential-harvesting payload, not package-aligned tooling.