Malicious packages, on record.

This is concrete unconsented install-time reconnaissance, exfiltration, persistence, and filesystem mutation. The path gate and stated research purpose do not remove the malicious behavio...

The cwd guard narrows targeting but does not make the lifecycle-triggered internal reconnaissance consensual. Collection is retained locally and TLS validation is disabled.

This is concrete install-time persistence, cross-tenant reconnaissance, remote exfiltration, and runtime-code modification. The research-oriented comments do not negate the implemented be...

This is concrete install-time persistence and data exfiltration, with conditional cross-build dependency mutation. The package's research framing and sandbox guard do not make these actio...

A narrow guard does not make unconsented install-time reconnaissance acceptable in the environment it targets. The lifecycle-triggered collection and external callback establish concrete...

This is concrete, automatic install-time credential and host-data exfiltration to an unrelated fixed endpoint. The behavior is not required by the package’s placeholder runtime library.

Direct manifest inspection confirms an automatic preinstall hook that exfiltrates the complete process environment to an unrelated external webhook. This is concrete malicious install-tim...

Direct source inspection confirms an install-time metadata collection and external exfiltration chain. The package has no other source files establishing a legitimate package function.

The sole package behavior is an install-time cloud-metadata collection and external transmission chain, with no package functionality to justify it.

The only package file defines an automatic install-time identity-exfiltration command. This is concrete unauthorized data exfiltration.

The sole package file defines a postinstall collector/exfiltrator with no package functionality or user-invoked justification. The concrete install-time transmission warrants blocking.

Direct manifest inspection confirms an automatic postinstall hook that harvests the installer username and exfiltrates it. This is concrete malicious install-time behavior.

The sole package behavior is an automatic install hook that harvests ECS metadata and transmits it to an unrelated external endpoint. This is a concrete exfiltration chain, not a package-...

The only package source defines an automatic install-time collection and exfiltration chain targeting ECS metadata and host identity.

The only package file defines an install-time metadata-harvesting and external-exfiltration chain. This is concrete malicious behavior, not a package-aligned operation.

The sole package behavior is an install-time collection-and-exfiltration pipeline targeting ECS metadata and an unrelated external host.

Direct source inspection confirms an install-time cloud-metadata exfiltration chain to an external endpoint.

Source inspection confirms unconsented install-time collection and transmission of local environment metadata to a callback domain. This is concrete data exfiltration behavior.

Direct manifest inspection confirms two install-time scripts that fingerprint and exfiltrate the installer environment to an unrelated external callback domain. The empty runtime entrypoi...

The package performs unconsented install-time environment fingerprinting and external transmission, with no functional code that would justify it. This is concrete data exfiltration behav...

Direct source inspection confirms two automatic install hooks that exfiltrate host and environment metadata to an unrelated callback domain. The package provides no corresponding runtime...