npm credential and data exfiltration reports.

The package is a deliberately minimal CLI whose observable function is transmitting local identity data to an external endpoint. Although it has no install hook, explicit invocation still...

The package's only implemented runtime behavior is unconsented host fingerprint collection and transmission to an unrelated endpoint. This is concrete data exfiltration, despite not runni...

The package contains concrete, unconsented host-identity exfiltration to an unrelated endpoint when its entrypoint runs. This is malicious behavior despite the absence of lifecycle hooks.

The only implemented CLI behavior is covert host-identity exfiltration to an external callback, rather than contract verification. Although it is user-triggered rather than install-trigge...

The package has no apparent functional purpose beyond sending local host identity data to an out-of-band endpoint. The explicit collection and transmission are concrete malicious behavior...

The package has no legitimate implementation beyond collecting and exfiltrating host identity information to an unrelated endpoint. Although it lacks an install hook, its user-invoked exe...

The package has no apparent schema-generation implementation; its only executable harvests host identity information and sends it to an external callback without notice. This is concrete...

The package's only implemented behavior is collecting local identity data and posting it to a hard-coded external callback. The absence of an install hook limits the trigger but does not...

The package's implemented behavior is an external transfer of local identity and host data to an unrelated hard-coded endpoint. Explicit CLI invocation does not make this covert fingerpri...

This is unconsented install-time collection and remote transmission of host-identifying information. The duplicate lifecycle callbacks and suppressed failures make it concrete malicious i...

This package performs unconsented, automatic install-time transmission of host-identifying data to an unrelated endpoint. The behavior is concrete exfiltration and warrants blocking.

The package performs unconsented install-time collection and transmission of local host metadata to an unrelated external endpoint. The benign runtime placeholder does not justify or miti...

Direct source inspection confirms two automatic lifecycle hooks that silently exfiltrate host and project identifiers to an unrelated endpoint. The benign placeholder entrypoint does not...

Direct inspection confirms two automatic lifecycle hooks that silently exfiltrate host and project metadata to an external endpoint. The runtime entrypoint is inert, so the harmful behavi...

The source implements automatic remote transmission of clipboard data from a deliberately hidden background process. This is concrete data exfiltration, not merely a user-requested AI req...

This package performs unconsented install-time collection and network exfiltration of host identity, user identity, and install-path data. Its embedded research-purpose statements are not...

This is confirmed unconsented install-time collection and exfiltration of local system and user metadata. The empty runtime entrypoint does not mitigate the malicious lifecycle behavior.

Direct source inspection confirms automatic collection and Telegram upload of the importing process's working directory. This is a concrete credential/data-exfiltration chain, not a benig...

Despite its stated research purpose, the package automatically exfiltrates identifying build-environment data during installation through two network channels. This is concrete unconsente...

This is concrete, unconsented install-time host-data exfiltration disguised as a placeholder package. It warrants blocking.

The package has no apparent functionality beyond an unconsented install-time hostname beacon to an unrelated hard-coded endpoint. This is concrete data exfiltration behavior.