npm credential and data exfiltration reports.

Source confirms automatic remote logging of an object type that includes email credentials. The benign postinstall script does not mitigate this concrete exfiltration path.

The malicious behavior is directly reachable at install time and has no package-related purpose. It combines host/credential-context collection, metadata probing, and external exfiltration.

Direct source inspection confirms concrete install-time data collection and exfiltration. The benign main entrypoint does not mitigate the malicious lifecycle behavior.

This is concrete, automatic install-time data exfiltration unrelated to the package's advertised utility functions. The benign index entrypoint does not mitigate the malicious lifecycle p...

Direct source inspection confirms automatic remote transmission of sensitive account configuration to an unrelated logging endpoint. This is a concrete credential-exfiltration path, not m...

Source establishes a direct runtime path from configured IMAP passwords to a third-party logging endpoint. The lack of install hooks does not mitigate this concrete credential-exfiltratio...

This is unconsented install-time collection and DNS exfiltration of host data, not a package-aligned setup action. The concrete lifecycle-triggered network behavior warrants blocking.

Source establishes a concrete, user-data-bearing request to an unrelated endpoint during normal Android initialization. It can include IMAP credentials, making this credential exfiltratio...

Source establishes a concrete default-enabled runtime data-exfiltration path to package-embedded external webhooks. The lack of install hooks does not mitigate this application-runtime be...

Source confirms an undisclosed, automatic and detached upload path for local AI conversation content. No install-time hook is present, but runtime data exfiltration is concrete.

Source directly implements unconsented install-time collection and exfiltration of local system data. This is concrete malicious behavior, not a package-aligned feature.

Direct source inspection confirms raw credential exfiltration to a package-author-controlled endpoint. The lack of an install hook limits automatic reachability but does not remove the co...

Direct source inspection confirms a concrete credential-exfiltration path in the Android runtime. The lifecycle script itself is not the attack vector.

The source implements unconsented transmission of mail-account configuration, including potential IMAP credentials, to a third-party logging host. This is concrete credential exfiltration...

Source confirms concrete remote exfiltration of clipboard data and screenshots, activated by the package’s advertised executable. Absence of an install hook does not remove the malicious...

The package contains a concrete automatic data-exfiltration path to an unrelated host, including a path that can send IMAP credentials. This outweighs the otherwise mail-aligned network b...

The package explicitly transmits a consumer credential to a hard-coded developer endpoint during normal use. Lack of an install hook does not mitigate this concrete credential-exfiltratio...

Source directly confirms unconsented install-time collection and external transmission of local system data. This is concrete malicious exfiltration, not a benign package feature.

This is concrete, unconsented install-time collection and exfiltration of local host data to an unrelated external endpoint.

This is concrete, unconsented install-time system-information exfiltration, explicitly framed as a dependency-confusion proof of concept. The source directly establishes the behavior.

Source confirms unconsented install-time host-data exfiltration to an external endpoint. This is concrete malicious behavior, not a scanner-only inference.