npm credential and data exfiltration reports.

The package has no delivered runtime implementation but performs an unconsented external hostname beacon during `postinstall`. This is concrete install-time data exfiltration and warrants...

This is a concrete import-time malware chain with stealthy persistence and credential exfiltration; the absence of npm lifecycle hooks does not mitigate it.

This is a concrete malware chain executed automatically on import, not a test fixture or package-aligned feature. The absence of npm lifecycle hooks does not mitigate import-time credenti...

This is a concrete delayed malware chain embedded in a purported Base58 utility: covert payload staging, persistence, wallet/credential harvesting, remote activation, and exfiltration.

Concrete default-on remote transmission of local AI conversation content to a hard-coded plaintext endpoint is data exfiltration behavior. The install hook is package-scoped, but it does...

Direct source inspection confirms an unconsented install-time malicious chain: secret theft, exfiltration, cryptocurrency draining, and persistence. This is unrelated to the package’s cla...

This is concrete install-time configuration of an enabled full-content trace uploader to a hard-coded external endpoint, followed by automatic backend startup. The conditional user-ID gat...

This is a concrete import-time persistence and credential-exfiltration chain concealed behind ABI helpers. The lack of npm lifecycle hooks does not mitigate the malicious runtime behavior.

This is a concrete import-time malware chain with persistence and credential exfiltration; it is unrelated to the advertised Arbitrum utility functions. Lack of an npm lifecycle hook does...

Source inspection confirms an import-time persistence and credential-exfiltration chain concealed behind benign SDK functions. The lack of lifecycle hooks does not mitigate runtime execut...

This is a concrete import-time persistence and credential-exfiltration chain hidden behind unrelated Ethereum utilities. The absence of npm lifecycle hooks does not mitigate runtime impor...

This is concrete import-time malware, not a package-aligned utility feature. The encoded fixture is an active second stage for persistence and credential exfiltration.

This is a concrete import-time malware chain with stealthy persistence and credential exfiltration, unrelated to the advertised Solana utility functions.

This is concrete import-time malware behavior, not a package-aligned validation feature. The absence of npm lifecycle hooks does not mitigate the delayed runtime dropper and credential ex...

Direct source inspection confirms a concealed import-time persistence and credential-exfiltration chain. The benign SDK facade and absence of lifecycle hooks do not mitigate this runtime...

Source inspection confirms concrete, automatic install-time data exfiltration through lifecycle hooks. The package has no implementation supporting a legitimate purpose for these calls.

This package contains a concealed import-time malware chain unrelated to its documented Arbitrum utilities. The staged payload provides persistence and credential exfiltration with concre...

The package contains a concealed import-time dropper and a decoded credential-stealing payload with persistence and network exfiltration. This is concrete malicious behavior unrelated to...

This is a concrete, concealed import-time credential theft and persistence chain, not ABI functionality or a scanner-only signal.

This is a concrete hidden import-time malware chain with persistence and credential exfiltration, unrelated to the package's advertised Ethereum helper functions.

Source inspection confirms a concrete automatic exfiltration path for sensitive account metadata to a custom endpoint. The harmless workspace-only postinstall hook does not mitigate that...