npm credential and data exfiltration reports.

The declared entrypoint performs direct, unconsented data exfiltration to a fixed third-party endpoint. The absence of lifecycle hooks does not remove the import-time attack surface.

The package's import-time entrypoint exfiltrates profile content and diagnostics to an unrelated external webhook. The absence of an install hook does not mitigate this concrete runtime d...

index.js is a side-effecting import-time fetch that forwards remote profile data and errors to webhook.site, which is a concrete exfiltration sink rather than a library. Empty metadata an...

The only source file is an import-time fetch of /profile that posts the body or error details to webhook.site. That is concrete data exfiltration, not package-aligned networking.

The only runtime code is an import-time steal of /profile posted to webhook.site, which is concrete data theft rather than a library. Empty metadata and a main entry that only performs th...

This is concrete runtime data exfiltration, not merely a network-capable chat API: received photo attachment URLs are silently forwarded to ImgBB. The lack of an install hook does not mit...

The package automatically exports full traced URLs to a vendor endpoint while constructing URLs that embed bearer tokens. This is a concrete credential-exfiltration path, not ordinary use...

The published main module is only an import-time probe of secret and admin paths that posts their contents to /addPost. That is concrete data theft, so the package should be blocked even...

Runtime login posts Facebook email, password, and 2FA to a hardcoded unofficial host instead of Facebook, including the default email/password path. That is a concrete credential-theft si...

The fixed external credential redirect is concrete runtime exfiltration behavior. The lack of an install hook limits the trigger but does not make the exposed behavior benign.

The executable entry point harvests browser page data and transmits flag-like values or markup without an application-facing API or stated purpose. This is concrete data exfiltration beha...

Inspected source shows import-time localStorage token theft and a fetch POST with no legitimate widget code. That is concrete credential exfiltration, so the package is blocked.

The hard-coded remote destination receives an environment credential without a configurable or source-verifiable authorization boundary. Although activation is user-invoked and there is n...

The package contains a concrete credential-exfiltration path through a hard-coded remote logging endpoint. Absence of an npm lifecycle hook does not remove the runtime risk.

index.js is an import-time localStorage thief that POSTs the dump to /addPost, with no legitimate helper surface. That is concrete client-side exfiltration, not a noisy network primitive.

index.js is an import-time scrape-and-post payload that copies .flag-value from /profile to /addPost, which does not match a feed widget helper. That is concrete data theft even though th...

index.js is a load-time same-origin thief: it scrapes .flag-value from /profile and POSTs it to /addPost with no user API. That is a complete data-theft chain, not a documented widget.

The published main module is only an import-time fetch of /Profile followed by a POST of that body to /addPost, with no helper API. Combined with an empty manifest and no install hooks, t...

The published main file immediately exfiltrates browser cookies to webhook.site. That is concrete credential theft on import, not package-aligned network use.

The manifest-reachable CommonJS entrypoint loads dist/index.js, which sends supplied credentials to an unrelated hardcoded gateway. The absence of an install hook does not remove this run...

The package contains concrete cryptocurrency transaction signing and transfer logic routed through a fixed gateway with hard-coded fee accounts. Although execution is command-triggered ra...