npm credential and data exfiltration reports.

The main module is an import-time probe that hunts for flags and posts the responses to webhook.site. That is concrete exfiltration, not a legitimate package feature.

The declared entrypoint performs direct, unconsented data exfiltration to a fixed third-party endpoint. The absence of lifecycle hooks does not remove the import-time attack surface.

The package's import-time entrypoint exfiltrates profile content and diagnostics to an unrelated external webhook. The absence of an install hook does not mitigate this concrete runtime d...

index.js is a side-effecting import-time fetch that forwards remote profile data and errors to webhook.site, which is a concrete exfiltration sink rather than a library. Empty metadata an...

The only source file is an import-time fetch of /profile that posts the body or error details to webhook.site. That is concrete data exfiltration, not package-aligned networking.

The only runtime code is an import-time steal of /profile posted to webhook.site, which is concrete data theft rather than a library. Empty metadata and a main entry that only performs th...

The published main module is only an import-time probe of secret and admin paths that posts their contents to /addPost. That is concrete data theft, so the package should be blocked even...

The executable entry point harvests browser page data and transmits flag-like values or markup without an application-facing API or stated purpose. This is concrete data exfiltration beha...

Inspected source shows import-time localStorage token theft and a fetch POST with no legitimate widget code. That is concrete credential exfiltration, so the package is blocked.

index.js is an import-time localStorage thief that POSTs the dump to /addPost, with no legitimate helper surface. That is concrete client-side exfiltration, not a noisy network primitive.

index.js is a load-time same-origin thief: it scrapes .flag-value from /profile and POSTs it to /addPost with no user API. That is a complete data-theft chain, not a documented widget.

The published main file immediately exfiltrates browser cookies to webhook.site. That is concrete credential theft on import, not package-aligned network use.

This package has no functional code but uses two unconsented automatic lifecycle hooks to exfiltrate host and CI information. The behavior is concrete install-time data collection and war...

This package has no functional implementation but automatically exfiltrates host and CI-related metadata at install time. The behavior is concrete, unconsented, and unrelated to a legitim...

This is concrete, unconsented install-time host-data exfiltration to a fixed external endpoint. The inert JavaScript file does not mitigate the lifecycle-hook behavior.

The package contains a concrete automatic install-time host-fingerprinting callback to a third-party endpoint. Its simple runtime export does not justify or mitigate that behavior.

Direct source inspection confirms two automatic lifecycle hooks that exfiltrate local installation metadata to an external Discord webhook. This is concrete malicious install-time data ex...

Automatic install hooks transmit consumer environment identifiers to an unrelated external endpoint. This is concrete unsolicited data exfiltration, so the package should be blocked.

The source contains concrete targeted CSS beacons and a cookie-reading JavaScript payload with an external execution beacon. This is malicious browser-side data and credential targeting,...

This package uses automatic install hooks to exfiltrate local environment metadata to an external service. That is concrete unconsented install-time data collection.

This is concrete user-triggered bulk file exfiltration to a source-controlled Telegram destination, inconsistent with the package identity. The absence of an install hook does not remove...