npm credential and data exfiltration reports.

This is concrete install-time execution of an obfuscated payload with credential-token handling and network behavior, unrelated to the package's stated translation role. The GitHub releas...

This is concrete unconsented install-time execution of an obfuscated credential-oriented payload, not a package-aligned setup task. The downloader provides no integrity verification befor...

The install-time chain is unrelated to the advertised authentication SDK and contains concrete credential-harvesting plus remote-code execution behavior.

The preinstall bootstrap deliberately runs an obfuscated, dynamically evaluated payload with credential-handling code. The benign dist library does not justify this installation behavior.

The benign-looking distributed SSO library does not justify an obfuscated preinstall downloader/interpreter bootstrapper that executes a credential-oriented payload. This is concrete mali...

Concrete install-time execution of an obfuscated credential-oriented network payload is malicious. The normal Jest files do not mitigate that behavior.

The preinstall chain is concrete and malicious: it bootstraps an obfuscated payload that dynamically executes remote content and harvests credentials. The ordinary Jest files do not mitig...

The lifecycle payload is concrete, concealed, and unrelated to an SSO backend. Its installer-triggered remote execution and credential handling meet the blocking threshold.

The install-time downloader/runner and obfuscated credential-oriented remote-eval payload establish a concrete malicious chain. The benign config entrypoint does not mitigate the preinsta...

The preinstall hook deliberately bootstraps and executes a large obfuscated payload with credential-token handling and remote evaluated code. This is concrete malicious install-time behav...

This is unrelated to an ESLint configuration and is concrete install-time execution, not a scanner-only signal. The benign ESLint entrypoint does not mitigate the malicious preinstall chain.

The lifecycle script is unrelated to a Jest configuration package and deliberately launches an obfuscated credential-capable payload at preinstall. The conventional preset files do not mi...

The lifecycle chain is concrete and the payload behavior is incompatible with an ESLint plugin. Legitimate rule-loading code does not mitigate the malicious preinstall payload.

The preinstall chain is unrelated to an ESLint config and concretely executes an obfuscated credential-focused remote-code payload. This is malicious install-time behavior.

This is not aligned with an ESLint configuration package: its preinstall loader executes a large obfuscated token-harvesting payload. The benign exported configs do not mitigate the insta...

The install hook executes an obfuscated, network-capable payload rather than package-aligned configuration code. Its remote eval and token-handling behavior establish malicious intent.

The preinstall lifecycle executes an obfuscated payload with remote eval and credential-related behavior, unrelated to the advertised repository-config function. This is concrete maliciou...

This behavior is unrelated to GraphQL configuration and executes without user consent during installation. The concrete remote eval and GitHub credential handling warrant blocking.

Direct source inspection confirms concrete malicious behavior, not merely suspicious primitives. The preinstall chain is unrelated to the package's stated ESLint-config purpose.

Direct source inspection confirms a preinstall downloader/runner and an obfuscated payload with remote eval and credential-handling behavior. The package is malicious.

Direct source inspection confirms an automatic, obfuscated install-time payload that harvests credentials and evaluates remote code. The benign configuration helper does not mitigate this...