npm credential and data exfiltration reports.

The UI distribution appears benign, but its install hook deliberately bootstraps and executes an unrelated obfuscated credential-capable payload. This is concrete malicious behavior, not...

Concrete install-time execution, remote binary bootstrapping, and an obfuscated token/network payload establish malicious behavior. The normal UI build does not mitigate the preinstall at...

Concrete install-time execution of an unrelated obfuscated payload with remote eval and credential-oriented logic is malicious. The benign library implementation does not justify the payl...

This is concrete, unconsented install-time execution of an obfuscated credential-harvesting payload, not package-aligned tooling.

This is concrete install-time execution of an obfuscated payload that targets GitHub credentials, unrelated to the published charting library. The explicit bootstrapper and payload form a...

The lifecycle chain provides concrete unconsented install-time execution of an obfuscated credential-harvesting and exfiltration payload. This is malicious, not a package-aligned dependen...

The benign title component is accompanied by an unrelated, obfuscated preinstall payload that downloads a runtime and supports remote eval and token access. This is concrete malicious ins...

The install hook is unrelated to an ESLint configuration package and launches a concealed credential-oriented payload. This is concrete malicious behavior, not a noisy static match.

This is unconsented preinstall execution of an obfuscated payload that collects and transmits GitHub credentials. The Bun download is a staging mechanism, not a package-aligned UI-library...

This is a concrete unconsented preinstall malware chain, not functionality aligned with a form UI package. The obfuscated payload directly combines credential harvesting, network exfiltra...

This is concrete malicious preinstall behavior: a web-components package downloads an interpreter to execute an unrelated obfuscated token-harvesting payload. The benign application runti...

This is concrete install-time execution of an obfuscated staged payload with credential-harvesting and upload behavior, unrelated to the advertised CLI. It warrants blocking.

This is a concrete install-time execution and credential-exfiltration chain, not a scanner-only inference.

The preinstall chain is unrelated to a React web SDK and deliberately launches an obfuscated payload. Source inspection confirms credential-oriented collection plus remote eval, which is...

Concrete install-time execution chains into an obfuscated credential collection and exfiltration payload. The normal SDK bundle does not justify this behavior.

The lifecycle hook is not package-aligned: it stages a runtime solely to execute an opaque payload absent from the normal library entrypoint. This is concrete install-time remote-code and...

The benign Babel entrypoint is accompanied by an unrelated install-time bootstrap that executes a concealed payload. The payload's credential handling and remote eval establish concrete m...

The package's legitimate entrypoint is trivial, while its unconsented preinstall executes a large obfuscated payload with credential and network capabilities. This is concrete malicious i...

The install hook is unrelated to the declared Babel plugin and actively stages an obfuscated executable payload. Source inspection confirms concrete credential and dynamic-code behavior.

The install hook is a concealed loader for an obfuscated payload with credential-related behavior and remote code evaluation. This is concrete malicious install-time execution, not functi...

This is concrete install-time execution of an obfuscated credential-stealing payload, not a package-aligned build helper. The bootstrapper makes execution occur without a user command.