npm credential and data exfiltration reports.

Runtime Sentry reporting can be package-aligned, but executing it automatically from preinstall with a hardcoded DSN and public-IP collection creates concrete unconsented install-time dat...

Direct source inspection confirms unconsented install-time collection and outbound exfiltration of host, CI, and credential-like environment data. The empty runtime entrypoint does not mi...

Direct source inspection confirms unconsented install-time host and credential-like environment collection with outbound HTTP and DNS callbacks. This is concrete malicious behavior despit...

Read-only source inspection confirms unconsented install-time collection and outbound transmission of credential-like environment variables and host identifiers. This is concrete maliciou...

Direct source inspection confirms unconsented install-time collection and exfiltration of credential-like environment data to non-package-aligned endpoints. Benign index.js and README.md...

Static source inspection confirms automatic install-time execution of credential/file harvesting, shell command execution, and outbound exfiltration. This behavior is unrelated to the cla...

Direct source inspection confirms concrete install-time exfiltration behavior with external network transmission and no package-aligned benign purpose. This should be blocked from publica...

Source inspection confirms repeated install-time credential/secret harvesting, external exfiltration, and unauthorized local API mutation with no package-aligned purpose. This is concrete...

Direct source inspection confirms install-time secret harvesting, external exfiltration, and local API mutation attempts in all lifecycle scripts. This is concrete malicious behavior with...

Source inspection confirms concrete data exfiltration behavior unrelated to an ESLint helper: sensitive file patterns are recursively collected from the caller's cwd and posted to a conce...

Direct source inspection confirms an install-time network callback that fingerprints and exfiltrates local user and host details. The behavior is unrelated to package functionality and is...

Source inspection confirms coordinated install-time data staging and import-time obfuscated network exfiltration. The behavior is unconsented and unrelated to legitimate Electron runtime...

Source inspection confirms unconsented install-time data collection and import-time exfiltration to an obfuscated remote endpoint. This is malicious behavior, not a package-aligned Electr...

Static source inspection confirms deliberate credential/config harvesting and exfiltration behind misleading helper/hash names and an obfuscated endpoint. Lack of lifecycle hooks lowers a...

Source inspection confirms concrete unconsented environment harvesting during postinstall and a runtime network path that encodes the staged marker into a remote request. This is not nece...

Source inspection confirms concrete install-time credential harvesting and exfiltration in postinstall.js, unrelated to the package's date utility functionality. This is malicious supply-...

Direct source inspection confirms install-time credential harvesting and exfiltration behavior in postinstall.js, with no relationship to the advertised date formatting functionality. Thi...

Direct source inspection confirms concrete install-time credential harvesting, host/container reconnaissance, and exfiltration behavior unrelated to package functionality. This warrants b...

Source inspection confirms unconsented install-time data staging plus obfuscated import-time network transmission logic unrelated to a legitimate Electron runtime helper. This is concrete...

Direct source inspection confirms unconsented install-time host reconnaissance and outbound exfiltration behavior in postinstall.js, with no package-aligned reason for metadata probing or...

Direct source inspection confirms install-time machine/user fingerprint exfiltration to an external domain, which is not package-aligned for a lightweight date utility. The benign runtime...