npm credential and data exfiltration reports.

Concrete postinstall credential collection and transmission are present in source. The package should be blocked.

The postinstall hook contains concrete, unconsented command execution and credential-related environment harvesting with network forwarding. The benign runtime export does not mitigate th...

This is concrete, obfuscated install/import-time metadata exfiltration, unrelated to the advertised utility package. The generic network helper does not mitigate the malicious DNS beacon.

Concrete install-time, obfuscated host-fingerprint exfiltration is present and unrelated to the advertised utility package. This is malicious behavior, not a benign network helper.

The package is a concealed remote data-collection and input-automation tool unrelated to its stated system-binary configuration purpose. Although no install hook runs it automatically, ex...

Source shows a concrete runtime exfiltration path for sensitive account configuration to a non-service logging endpoint. This exceeds ordinary package telemetry and is not install-time de...

The third-party logging endpoint receives sensitive account configuration without a user-facing consent boundary. No install hook is needed for this runtime exfiltration to be malicious.

Direct inspection confirms default runtime cookie exfiltration unrelated to icon rendering. No install hook is needed for this concrete malicious behavior.

Direct source inspection confirms runtime cookie exfiltration to external endpoints; no install hook is required for the malicious behavior.

Concrete source shows automatic, suppressed transmission of mail/account-related logs to an unrelated remote endpoint. The benign workspace-only postinstall hook does not mitigate this ru...

Source inspection confirms a runtime path that silently transmits user credential-bearing configuration to a non-service logging endpoint. This is concrete credential exfiltration, not me...

This is concrete, runtime-reachable credential/data exfiltration rather than a benign scanner primitive. The install hook itself is benign, but it does not mitigate the Android payload.

The source establishes a direct runtime path from IMAP configuration to a third-party logging URL; it is not required for the claimed storage functionality. No lifecycle hook is needed fo...

Source establishes a concrete credential-exfiltration chain triggered by an ordinary product command and persisted through its worker. The authentication precondition does not provide inf...

The package contains default, active external webhook endpoints and sends rich runtime records to them automatically. No install hook is present, but the runtime exfiltration behavior is...

Direct source inspection confirms an automatic preinstall hook performing local-file and host-data exfiltration to an external OAST endpoint. This is concrete malicious behavior, not mere...

This is concrete credential harvesting and remote exfiltration from a separate application's secret store, automatically coupled to an ostensibly local usage-start action. Authentication...

This is concrete, unconsented install-time metadata exfiltration concealed by obfuscation, not a package-aligned utility feature.

This is concealed, automatic host-data exfiltration at install/import time, unrelated to the advertised utilities.

Concrete obfuscated host-metadata collection and DNS exfiltration run automatically at install and import. The exported utilities do not justify this hidden beacon.

Source confirms credential harvesting and remote transmission of app secrets and renewable personal tokens, initiated silently after an adjacent authorization workflow. This is concrete c...