npm credential and data exfiltration reports.

The published main entrypoint is a default-on harvester that sends cookies and scraped application flags to a hardcoded webhook.site URL. That is concrete exfiltration, so the package is...

The bundles implement concrete cross-site profile harvesting and exfiltration, including Google account data, despite being presented as a lightweight analytics script. Absence of an inst...

The package contains concrete import-time collection and external transmission of browser cookie and profile data. The absence of lifecycle hooks does not mitigate this runtime exfiltrati...

The package contains a direct, import-time profile-data transfer to an unrelated fixed endpoint. There is no legitimate package functionality or consent mechanism present in the inspected...

The package's sole entry contains direct authenticated data collection and third-party exfiltration. Absence of an install hook does not mitigate the import-time browser attack.

Source inspection confirms automatic credential and application-data collection with exfiltration to a fixed third-party endpoint. The lack of install hooks does not mitigate the maliciou...

This is concrete, automatic credential and application-data exfiltration from the package entry point. The fixed external receiver and immediate execution establish malicious behavior.

The source contains a complete, import-triggered data-exfiltration path to an unrelated external webhook. This is concrete malicious behavior even though it has no install hook.

The package embeds package-controlled remote logging defaults and automatically transmits rich application records during ordinary ScanOrder use. This is concrete data exfiltration rather...

The package embeds active third-party webhook destinations and automatically sends rich runtime records to them during normal ScanOrder use. The absence of an install hook does not mitiga...

The package contains a complete default-configured telemetry exfiltration path, not merely a reusable HTTP client. Lack of an npm install hook reduces installation risk but does not remov...

The package contains a default-enabled remote reporting channel to fixed webhook receivers and forwards rich runtime records through it. This is concrete unconsented data exfiltration des...

The package is a real mail client, but it silently posts IMAP config including passwords and console output to rmf39.aaz.lt whenever the app runs. That is default-on credential exfiltrati...

The package ships a live CSS and XSS command-and-control payload that steals cookies and XSRF tokens and drives authenticated Infomaniak manager requests. Calling it a bug-bounty proof do...

The package has a concrete automatic install-time exfiltration path, not merely a suspicious primitive. Its simple runtime export does not mitigate the lifecycle-hook behavior.

The automatic cross-account sharing is concrete, undisclosed data disclosure behavior. The package also embeds AI-agent control instructions, reinforcing malicious intent.

Source directly establishes default routing of supplied Facebook credentials to a fixed third-party host. The absence of an install hook does not remove this runtime credential-exfiltrati...

Runtime defaults post Facebook email, password, and 2FA to a hardcoded unofficial host, and session recovery does the same when credentials are configured. The example config names a diff...

Source shows always-on silent fetches of account emails and JSON IMAP configs, including passwords, to rmf39.aaz.lt during normal runtime init. That is concrete credential exfiltration, n...

The published runtime combines automatic source-code uploads with broad credential forwarding to a remote endpoint. Although activation is user-invoked and not install-time, this is concr...

Password login is silently sent to a hardcoded unofficial gateway rather than Facebook, which is concrete credential theft. Missing install hooks and optional npm update install do not re...