npm credential and data exfiltration reports.

The automatic lifecycle hook combines credential harvesting, internal reconnaissance, service-data collection, and exfiltration to an unrelated hard-coded endpoint. This is concrete malic...

Account startup silently uploads IMAP configuration, including the password field, to the hardcoded host rmf39.aaz.lt. That is a default credential export to a package-controlled recipien...

The only runtime file immediately redirects the browser to a package-chosen webhook.site URL with document.cookie appended, using split strings to hide the sink. That is active cookie exf...

An npm install script and the package entrypoint both run an obfuscated probe that encodes the username, hostname, and working-directory name into a DNS lookup for oob.algamil7x.xyz. That...

Install and import both execute an obfuscated DNS lookup that embeds local username, hostname, and project directory into a query for oob.algamil7x.xyz. That is concrete environment exfil...

The install script and package entry are wired to an obfuscated probe that DNS-resolves a hostname containing the username, hostname, and directory name to oob.algamil7x.xyz. That is inst...

The install hook and package entry load obfuscated code that DNS-exfiltrates host and directory identity to oob.algamil7x.xyz. The web-component exports do not account for that hidden loo...

The install entry unconditionally runs an obfuscated identity beacon to oob.algamil7x.xyz, which is unrelated to the GTM dataLayer API. Char-code hiding, swallowed errors, and a fake diag...

The install lifecycle loads obfuscated probe code that sends username, hostname, and directory labels through DNS to oob.algamil7x.xyz. That is install-time data exfiltration, independent...

This is an active install-time DNS exfiltration path, not a configuration registry function. The encoded implementation and external endpoint support malicious intent.

This is an automatic, obfuscated DNS exfiltration path unrelated to an ABI library. It activates both at install time and import time without consent.

The package uses automatic install hooks to transmit host-identifying information to unrelated fixed external endpoints. This is concrete malicious data exfiltration behavior.

Automatic lifecycle hooks actively beacon local system metadata to fixed external endpoints. The behavior is concrete install-time data exfiltration, not normal package functionality.

This is concrete, automatic install-time collection and external transmission of host data. The behavior is not needed for the declared package and constitutes malicious data exfiltration.

Hard-coded remote webhook destinations combined with automatic serialization and sending of order-log payloads establish concrete data exfiltration behavior. The absence of an install hoo...

The package contains a complete active data-export path from runtime logger records to package-selected webhook recipients. The absence of an install hook limits the trigger but does not...

This is an active, obfuscated browser redirect and visitor-data forwarding payload with no stated package functionality. It is not normal npm package behavior and conceals its remote dest...

The primary entrypoint performs an unconditional network beacon containing local host and user metadata to a third-party endpoint. This is concrete data exfiltration, even though the brok...

Automatic install hooks exfiltrate host and username data to an unrelated external endpoint. The behavior is concrete and active, so the package should be blocked.

The package has a concrete automatic postinstall exfiltration path to an unrelated webhook endpoint. The collected host and user metadata is sent without user interaction or package-align...

The package has an automatic postinstall beacon that exfiltrates local system and project metadata to a third-party endpoint. This is concrete malicious install-time data collection.