npm credential and data exfiltration reports.

Concrete obfuscated metadata collection and DNS exfiltration execute automatically at install and import. This is unrelated to the package’s stated utility/descriptors purpose.

Source confirms a credential-bearing endpoint redirection, not merely a benign setup helper. The lack of an install hook does not remove the concrete credential-exfiltration chain trigger...

The concealed outbound request, silent failure handling, and complete mismatch with the package name establish a concrete data-exfiltration capability. There is no install hook, but runti...

The source implements a concrete credential-routing configuration change, not a normal Anthropic setup. The absent manifest entrypoint limits activation but does not make the source behav...

Source establishes an automatic credential-bearing telemetry path to an unrelated host. The benign install hook and explicit MCP utility do not mitigate this runtime exfiltration.

Source directly establishes automatic third-party transmission of account configuration that can include passwords. The benign workspace-only postinstall does not mitigate the runtime exf...

This is concrete, unconsented install-time metadata exfiltration, not merely a benign dependency-confusion notice. The package should be blocked.

This is concrete import-time malware execution, not calendar functionality or a scanner-only signal. The concealed native payload provides credential theft and exfiltration capabilities.

Source establishes unconsented API-key disclosure to a remote relay, not merely a risky primitive. The remote-command capability magnifies the impact.

This is concrete credential disclosure to a package-controlled relay, not merely an advertised AI-agent capability. Persistent arbitrary code loading and an opaque executable bytecode pay...

Direct source establishes unredacted API-key disclosure to a hard-coded third-party relay and remote task control. This is concrete credential-exfiltration behavior, not a scanner-only in...

The explicit daemon command is not install-time behavior, but it concretely discloses API credentials to a relay and exposes remote command execution. This exceeds a benign remote-agent c...

Source establishes credential transmission to a package-controlled relay, not merely an advertised remote-agent capability. The absence of install hooks does not mitigate this runtime exf...

This is concrete credential exfiltration to a package relay and a remotely directed command-execution path, not merely an advertised agent capability. No install hook is needed for the ha...

The credential transmission and remote-control chain are directly present in source, not inferred from scanner labels. Explicit user activation does not justify transmitting a BYOK key to...

This is concrete credential disclosure to a remote relay combined with remote host-control capability; it is not merely an inert agent toolset. No install lifecycle hook was found, but ru...

Source inspection confirms a concrete credential-exfiltration and remote-command-control chain, not merely a bytecode or network heuristic. The explicit runtime trigger does not remove th...

Source confirms a default runtime path that forwards rich application logs to package-embedded external receivers. The absence of install hooks reduces installation risk but does not remo...

This is concrete, automatic exfiltration of conversation content after required login, not merely a user-invoked sync feature. The package's documented opt-in and privacy claims conflict...

This is a concealed native screen-monitoring payload unrelated to an LRU cache and activated without user consent on import. The source launcher makes the binary's remote capability direc...

This is a concrete, automatic credential and account-data exfiltration path, not merely a suspicious primitive. The install hook itself is benign, but runtime behavior warrants blocking t...