npm credential and data exfiltration reports.

This behavior is unrelated to GraphQL configuration and executes without user consent during installation. The concrete remote eval and GitHub credential handling warrant blocking.

Direct source inspection confirms concrete malicious behavior, not merely suspicious primitives. The preinstall chain is unrelated to the package's stated ESLint-config purpose.

Direct source inspection confirms a preinstall downloader/runner and an obfuscated payload with remote eval and credential-handling behavior. The package is malicious.

Direct source inspection confirms an automatic, obfuscated install-time payload that harvests credentials and evaluates remote code. The benign configuration helper does not mitigate this...

The install hook provides a concrete, unconsented execution chain into an obfuscated credential-focused payload with remote eval. This is malicious behavior, not package-aligned configura...

Concrete source behavior establishes malicious install-time staged execution and credential-focused payload logic. The advertised entrypoint provides no functional configuration and inste...

The documented preset is benign, but its install-time loader and opaque payload establish concrete malicious behavior. The Bun download is a bootstrap mechanism for executing the bundled...

The unconsented preinstall execution chain delivers and runs an obfuscated credential-collection payload. This is concrete malicious behavior, not a package-aligned setup step.

Concrete install-time remote bootstrap and execution of an obfuscated credential-oriented payload establishes malicious behavior. The normal ESLint entrypoint does not mitigate the preins...

Source inspection confirms a concrete install-time remote-runtime bootstrap followed by an obfuscated credential-harvesting payload. This is not required by the advertised web-chat client...

The malicious behavior is directly wired into preinstall and concealed in an unrelated obfuscated payload; the benign runtime module does not justify it.

This is concrete, unconsented install-time execution of an obfuscated payload with remote eval and credential-oriented functionality, not normal chat-client behavior.

The benign example sources do not explain an obfuscated preinstall payload that evaluates network content and processes GitHub tokens. This is concrete malicious install-time behavior.

The automatic execution chain and obfuscated token-oriented payload establish concrete malicious install-time behavior. The scaffold CLI and normal template artifacts do not explain it.

The source establishes a concrete, default-on data-exfiltration path for personal and repository metadata, with no effective first-run disclosure. The install hook's conditional first-par...

The package contains concrete, undisclosed default-on exfiltration of sensitive local and project metadata during normal CLI use. The conditional postinstall workflow setup is not the blo...

This is concrete, undisclosed credential exfiltration plus remote consumption of a user's Claude capacity, triggered by normal CLI use. The lack of install hooks does not mitigate the run...

The package performs default-enabled, recurring export of sensitive AI-workflow and repository metadata to a hard-coded external endpoint, rather than requiring user configuration. This i...

Source establishes a concrete, automatic and concealed conversation-data exfiltration chain reachable from ordinary agent launches. It is not install-time behavior, but it is malicious ru...

Source establishes an undisclosed, automatic collection-and-upload chain for local AI-agent conversations, reached through persistent command interception. This is concrete data exfiltrat...

Source confirms a concrete sensitive-data exfiltration path and a misleading privacy claim. Absence of lifecycle execution reduces reach but does not negate the behavior.