npm credential and data exfiltration reports.

This is a concrete preinstall staged-payload chain, not a package-aligned frontend utility. The executed payload contains credential-targeting and outbound transfer logic.

This is concrete, unconsented install-time execution of an obfuscated credential-stealing payload, not package-aligned setup. The benign dist logger does not mitigate the malicious lifecy...

The unconsented preinstall bootstrap and concealed obfuscated payload form a concrete malicious execution chain. The benign logger build does not mitigate lifecycle compromise.

Concrete preinstall execution, obfuscated dynamic evaluation, and credential-handling logic establish malicious behavior; the visible package purpose does not require this payload.

The package contains a concrete, unconsented install-time credential-harvesting chain, concealed behind an obfuscated payload and external runtime bootstrap. Its legitimate loader entrypo...

Source inspection confirms a concrete malicious preinstall chain, not merely suspicious static primitives. Block publication.

The preinstall chain executes a concealed payload whose source explicitly targets multiple credential classes and transmits them. This is concrete malicious behavior, not package-aligned...

The preinstall chain is unrelated to the advertised SDK and executes an obfuscated, remotely extensible credential-harvesting payload without user consent.

This is concrete install-time execution of an obfuscated payload with credential-token handling and network behavior, unrelated to the package's stated translation role. The GitHub releas...

This is concrete unconsented install-time execution of an obfuscated credential-oriented payload, not a package-aligned setup task. The downloader provides no integrity verification befor...

The install-time chain is unrelated to the advertised authentication SDK and contains concrete credential-harvesting plus remote-code execution behavior.

The preinstall bootstrap deliberately runs an obfuscated, dynamically evaluated payload with credential-handling code. The benign dist library does not justify this installation behavior.

The benign-looking distributed SSO library does not justify an obfuscated preinstall downloader/interpreter bootstrapper that executes a credential-oriented payload. This is concrete mali...

Concrete install-time execution of an obfuscated credential-oriented network payload is malicious. The normal Jest files do not mitigate that behavior.

The preinstall chain is concrete and malicious: it bootstraps an obfuscated payload that dynamically executes remote content and harvests credentials. The ordinary Jest files do not mitig...

The lifecycle payload is concrete, concealed, and unrelated to an SSO backend. Its installer-triggered remote execution and credential handling meet the blocking threshold.

The install-time downloader/runner and obfuscated credential-oriented remote-eval payload establish a concrete malicious chain. The benign config entrypoint does not mitigate the preinsta...

The preinstall hook deliberately bootstraps and executes a large obfuscated payload with credential-token handling and remote evaluated code. This is concrete malicious install-time behav...

This is unrelated to an ESLint configuration and is concrete install-time execution, not a scanner-only signal. The benign ESLint entrypoint does not mitigate the malicious preinstall chain.

The lifecycle script is unrelated to a Jest configuration package and deliberately launches an obfuscated credential-capable payload at preinstall. The conventional preset files do not mi...

The lifecycle chain is concrete and the payload behavior is incompatible with an ESLint plugin. Legitimate rule-loading code does not mitigate the malicious preinstall payload.