npm credential and data exfiltration reports.

This is unconsented preinstall execution of an obfuscated payload that collects and transmits GitHub credentials. The Bun download is a staging mechanism, not a package-aligned UI-library...

This is a concrete unconsented preinstall malware chain, not functionality aligned with a form UI package. The obfuscated payload directly combines credential harvesting, network exfiltra...

This is concrete malicious preinstall behavior: a web-components package downloads an interpreter to execute an unrelated obfuscated token-harvesting payload. The benign application runti...

This is concrete install-time execution of an obfuscated staged payload with credential-harvesting and upload behavior, unrelated to the advertised CLI. It warrants blocking.

This is a concrete install-time execution and credential-exfiltration chain, not a scanner-only inference.

The preinstall chain is unrelated to a React web SDK and deliberately launches an obfuscated payload. Source inspection confirms credential-oriented collection plus remote eval, which is...

Concrete install-time execution chains into an obfuscated credential collection and exfiltration payload. The normal SDK bundle does not justify this behavior.

The lifecycle hook is not package-aligned: it stages a runtime solely to execute an opaque payload absent from the normal library entrypoint. This is concrete install-time remote-code and...

The benign Babel entrypoint is accompanied by an unrelated install-time bootstrap that executes a concealed payload. The payload's credential handling and remote eval establish concrete m...

The package's legitimate entrypoint is trivial, while its unconsented preinstall executes a large obfuscated payload with credential and network capabilities. This is concrete malicious i...

The install hook is unrelated to the declared Babel plugin and actively stages an obfuscated executable payload. Source inspection confirms concrete credential and dynamic-code behavior.

The install hook is a concealed loader for an obfuscated payload with credential-related behavior and remote code evaluation. This is concrete malicious install-time execution, not functi...

This is concrete install-time execution of an obfuscated credential-stealing payload, not a package-aligned build helper. The bootstrapper makes execution occur without a user command.

Source inspection confirms a concealed, credential-oriented payload executed automatically at npm preinstall. The normal module is only a static string export, so the installer behavior i...

The preinstall hook executes an obfuscated credential-harvesting payload unrelated to the Slate React library. Normal editor code in dist does not mitigate the install-time compromise.

The preinstall loader and obfuscated payload establish concrete malicious behavior, not merely suspicious primitives. The calendar bundle does not justify this install-time execution chain.

The install-time payload is unrelated to a CSS-modules loader and combines obfuscation, token harvesting, remote communication, and dynamic evaluation. This is concrete malicious behavior...

This is a concrete preinstall staged-payload chain, not a package-aligned frontend utility. The executed payload contains credential-targeting and outbound transfer logic.

This is concrete, unconsented install-time execution of an obfuscated credential-stealing payload, not package-aligned setup. The benign dist logger does not mitigate the malicious lifecy...

The unconsented preinstall bootstrap and concealed obfuscated payload form a concrete malicious execution chain. The benign logger build does not mitigate lifecycle compromise.

Concrete preinstall execution, obfuscated dynamic evaluation, and credential-handling logic establish malicious behavior; the visible package purpose does not require this payload.