npm credential and data exfiltration reports.

The package performs unconsented postinstall environment collection, internal metadata probing, persistence, and third-party reporting. Its self-description does not neutralize these conc...

The package contains an automatic install-time data-collection and external-egress path, not merely an inert test fixture. Its self-described testing purpose does not provide consumer con...

This is unconsented install-time internal-service probing and external disclosure of returned data. The automatic lifecycle hook makes the behavior concrete and harmful.

This is a concrete automatic install-time and import-time data beacon to a third-party endpoint. Although the data is limited to host metadata, the package provides no consent mechanism a...

The package implements a concrete third-party credential collection path selected by default, including an automatic re-login trigger. The absence of an npm lifecycle hook does not remove...

This package implements an automatic preinstall host-fingerprinting and external exfiltration chain. Its behavior is concrete, unconsented, and unrelated to a normal WebRTC package function.

This is concrete, unconsented install-time data exfiltration to an unrelated endpoint. The lifecycle hook directly activates the collection and network request.

The encrypted remote redirect and query-parameter forwarding are concrete deceptive browser attack behavior. Although npm installation has no lifecycle execution, publishing this package...

The package contains concrete, undisclosed network exfiltration behavior unrelated to its claimed development-helper purpose. Although it has no install hook, the runtime beacon is suffic...

This is a concrete automatic credential-exfiltration payload with environment evasion and external transmission. The package's advertised utility exports do not account for this behavior.

This is an automatic install-time credential theft and exfiltration chain, not functionality aligned with an API gateway utility. The deliberate delays and environment guards further supp...

This is concrete automatic credential collection and exfiltration, unrelated to the stated order-management functionality. The postinstall hook makes the behavior run without an explicit...

This is a concrete, automatically triggered credential-exfiltration payload disguised behind inert exports. The behavior is malicious and warrants blocking publication.

This is an unconsented install-time credential theft and exfiltration payload. The postinstall trigger makes the attack reachable without any package API call.

This is a concrete automatic install-time credential-exfiltration chain, not package-aligned setup. The package should be blocked.

The lifecycle hook performs unconsented collection and attempted network transmission of sensitive installation-host data. This is concrete install-time credential and system-information...

The install hook performs concealed, automatic host-data exfiltration. The UI source does not mitigate this independent lifecycle attack.

The package contains a lifecycle-triggered collection-and-transmission command with no legitimate package functionality supporting it. This is concrete malicious install-hook behavior.

The package's sole substantive behavior is an automatic lifecycle hook that harvests environment and network data and sends it over the network. This is concrete credential and system-inf...

This is a concealed, remotely controlled redirect and query-forwarding mechanism, not a legitimate npm package function. It has no install hook, but its runtime behavior is concrete malic...

The package performs automatic environment capture during installation with no legitimate package functionality present. Although no exfiltration endpoint is included, the install-time co...