npm credential and data exfiltration reports.

This is concrete install-time host reconnaissance and outbound exfiltration to an unrelated Telegram recipient. The automatic lifecycle hook makes the behavior unconsented.

The source implements stealth, watchdog persistence, foreground capture, and external submission as one active workflow. Although installation itself does not activate the launcher, the c...

This is concealed, automatic host-data exfiltration through DNS during installation, unrelated to the stated Solana library function. The behavior is concrete malicious install-time data...

Automatic lifecycle execution collects sensitive local and build-environment data and sends it to unrelated external hosts. This is concrete malicious install-time exfiltration.

The sole published entrypoint contains direct browser-cookie exfiltration to an unrelated webhook endpoint. This is concrete malicious behavior rather than a package-aligned client request.

The package's only executable entrypoint contains direct cookie collection and transmission to an unrelated third-party endpoint. This is concrete credential exfiltration behavior.

The active package entrypoint automatically collects browser session-related data and forwards it to another endpoint. This is concrete malicious credential and data exfiltration behavior.

Runtime source establishes a complete default data-forwarding path to embedded external webhooks. The absence of install hooks limits the behavior to application runtime but does not remo...

The package contains a default-on, hardcoded external logging channel that sends application data without requiring the consumer to provide the destination. This is concrete data exfiltra...

The package contains an automatic, hard-coded production session recorder that captures network payloads and transmits them to a remote vendor endpoint. Header filtering does not prevent...

The reachable CLI sends API credentials to an unrelated default endpoint, which is concrete credential exfiltration behavior. The absence of an install hook does not remove the runtime ex...

The package installs a default external log receiver and transmits serialized application records to it. This is concrete data exfiltration behavior, despite the absence of an install lif...

The package contains a concrete default runtime data-export path to an external webhook, including arbitrary log payload and context fields. The absence of an install hook limits the trig...

A hard-coded external endpoint receives account credentials through an automatic recovery path. The absence of an install hook does not mitigate this concrete runtime credential-exfiltrat...

A default external endpoint receives account credentials through automatic recovery paths. This is concrete credential exfiltration behavior, not ordinary authentication to Facebook.

This is a concrete credential-exfiltration path, not ordinary authentication to the documented destination. The absence of an install hook does not remove the runtime risk.

The CLI prompts for THENUX keys from api.thenuxofc.store, persists them, and by default posts them to an undocumented workers.dev gateway. That is a hidden default export of user credenti...

The active Android entrypoint reaches a bundled sink that exports serialized IMAP configuration, which can include passwords, to a hardcoded third-party host. This is concrete credential...

The credential destination mismatch is concrete in the active CLI path, and the package forwards tool results to the same remote service. This is credential and data exfiltration behavior...

The package contains a reachable default export path for runtime records to hardcoded third-party webhooks and an unrestricted token-forwarding primitive. Caller overrides do not remove t...

The cheerleading metadata is cover: the ESM entry and extra source files execute obfuscated load-time code that overlays a fake Stripe payment iframe on checkout pages. That is a concrete...