npm credential and data exfiltration reports.

The undisclosed, hardcoded public database destination and credentials create a concrete default data-exfiltration path in generated projects. The absence of a lifecycle hook does not mit...

The package contains concrete, automatic browser-context exfiltration to a hard-coded third-party endpoint. The postinstall patch itself appears benign but does not mitigate the import-ti...

Direct source inspection confirms unconsented install-time host fingerprinting and external exfiltration. This is concrete malicious behavior, not merely a suspicious primitive.

Source directly implements automatic environment harvesting and external transmission during npm install. The malformed hostname may prevent delivery, but does not negate the concrete mal...

This is not an install-hook-only finding: the malicious payload is reached by an ordinary import. Its concealed host collection and outbound transmission are incompatible with the package...

The package implements a concrete automatic collection-and-exfiltration chain for administrator PII and deployment metadata unrelated to a user-invoked monitoring action. The lack of inst...

This is concrete, unconsented host-metadata exfiltration to a package-selected remote endpoint during ordinary use. The lack of an install hook does not mitigate the runtime data-exfiltra...

Direct inspection confirms a concrete install-time data-exfiltration chain with no apparent package-aligned functionality. This is malicious behavior, not merely a suspicious primitive.

The hard-coded third-party callback plus explicit content/message payload fields establishes a concrete runtime exfiltration surface. Explicit invocation and absent lifecycle hooks reduce...

Although no lifecycle hook runs at install, the source contains a concrete externally directed reporting channel that transmits host and deployment data after the package’s generated scri...

Source inspection confirms concrete preinstall-time collection and external transmission of local/CI metadata. The behavior is unrelated to the package's empty runtime export and is malic...

Source inspection confirms a concrete stealth, persistence, process-injection, protected-content-capture, and external-transmission chain. Although it lacks install hooks, the explicit co...

The hard-coded privileged account and unannounced outbound transfer of permanent guild invite links establish a concrete malicious access-and-exfiltration chain. The absence of install ho...

Source inspection confirms an unconsented install-time telemetry/exfiltration chain rather than a benign user-invoked monitoring feature. The lifecycle script collects a public IP and sen...

Source confirms a concrete, automatic install-time collection-and-upload chain rather than a scanner-only similarity match. The behavior is not required to install the library and uses a...

The install hook performs concrete network collection and remote reporting rather than a package-aligned build/setup task. Its hardcoded destination and forced demo event make the behavio...

Source inspection confirms concrete automatic install-time metadata exfiltration to an unrelated external endpoint. This is malicious behavior, not a benign package setup action.

The distributed source contains reachable default webhook configuration and direct POST logic for application records. The absence of install hooks or host-level primitives does not mitig...

Source confirms a concrete credential-exfiltration chain, not merely scanner heuristics. The install-time workflow setup is secondary and does not mitigate the silent credential upload.

Direct inspection confirms concrete hidden privileged access and outbound telemetry unrelated to user configuration. The lack of lifecycle hooks does not mitigate the runtime backdoor onc...

Source directly confirms automatic collection and forwarding of identifiable usage/profile data to a hard-coded external store. This is concrete unconsented telemetry exfiltration, not a...