npm credential and data exfiltration reports.

Source directly implements unconsented install-time host-data collection and external exfiltration. This is concrete malicious behavior, not a package-aligned feature.

The bundled rulesets contain a concrete credential/data forwarding chain in two target-browser artifacts. No install hook is needed for the payload to be harmful once a consumer loads the...

Direct source inspection confirms unconsented install-time collection and external exfiltration, unrelated to the package's stated player purpose.

Source confirms a normal-use path from stealthy host collection to a default third-party network request. The absence of an install hook does not mitigate this runtime data-exfiltration b...

Direct source inspection confirms deliberate, hard-coded exfiltration of credentials supplied by the package consumer. The lack of install hooks does not mitigate the malicious runtime be...

Direct source inspection confirms raw Discord-token disclosure to a hard-coded developer webhook. Absence of install hooks does not mitigate the concrete runtime credential-exfiltration p...

Source inspection confirms concrete, automatic exfiltration of a user-supplied credential to a hard-coded developer endpoint. No lifecycle hook is needed because the malicious behavior is...

Obfuscated network transmission of arbitrary caller input with no implemented validation is concrete malicious behavior. It is runtime-triggered rather than install-time, but warrants blo...

Source directly confirms unconsented install-time collection and exfiltration of local system data. This is concrete malicious behavior, not merely a suspicious primitive.

Source establishes a concrete covert collection-to-remote-message path, not merely a risky primitive. The absence of install hooks does not mitigate runtime data exfiltration after normal...

This is unrelated to the declared middleware behavior and executes without user invocation beyond importing the package. Obfuscation, host collection, outbound transmission, and command e...

Direct source inspection confirms an unconsented preinstall data-harvesting and exfiltration chain. No legitimate package functionality is present.

This is concrete, default-enabled data exfiltration to a package-controlled external endpoint, not merely local dashboard functionality. The absence of an npm lifecycle hook reduces insta...

Source inspection confirms an obfuscated, runtime-triggered collection-and-upload path for sensitive application data. The absence of install hooks does not mitigate this concrete exfiltr...

Direct source inspection establishes automatic transmission of an IMAP configuration object that may contain the password to an unrelated hard-coded host. This is concrete credential exfi...

Source establishes a concrete runtime credential/configuration exfiltration path to an unrelated endpoint. No install hook is needed for this malicious behavior.

The package contains concrete, import-triggered command execution and exfiltration rather than a merely user-invoked administrative feature. Its stated research purpose does not remove th...

Source establishes a concrete third-party credential-harvesting and exfiltration chain, activated by ordinary telemetry startup and insufficiently disclosed. This is malicious regardless...

This is concrete credential and secret collection with remote synchronization, not a package-aligned encryption primitive. Absence of lifecycle hooks limits activation to consumer runtime...

Source directly establishes a runtime path from account IMAP credentials to a silent third-party logging endpoint. No lifecycle hook is needed for the malicious behavior to activate in th...

Direct source inspection confirms concrete runtime cookie exfiltration under the guise of an icon component. The absence of install hooks does not mitigate this application-runtime attack.