npm persistence and destructive behavior reports.

The component contains a concrete, destructive action against the consuming application's DOM, guarded only by remote-controlled license status. No install hook is needed for this harmful...

The package combines deliberate obfuscation, an undisclosed remote control check, and destructive host-page behavior in a simple UI component. Although it has no install hook, the runtime...

The package contains a reachable boot path that automatically establishes persisted SSH-key access and listens on all interfaces. Although this is not an npm install hook, it is a concret...

The browser payload intentionally blocks a host page's controls behind an encoded overlay, which is concrete malicious behavior. Lack of a normal manifest entry limits automatic activatio...

This is concrete destructive runtime behavior unrelated to a flying-reaction UI, concealed by obfuscation and controlled by a remote endpoint. The absence of an install hook does not miti...

The package contains a concrete, automatic, and destructive install hook that mutates the consumer project without consent. No exfiltration was found, but the install-time deletion alone...

Although it has no install hook or network activity, the source implements concealed, hostile browser UI lockout behavior. The obfuscated published bundle corresponds to the readable sour...

The package contains an obfuscated payload that deliberately prevents users from interacting with the page and hides its execution source. Although it has no install hook or exfiltration,...

The source performs deliberate, broad browser interaction denial and hides its loader, while the package has no stated functionality or legitimate entrypoint explaining that behavior. Alt...

The manifest contains a concrete, automatic, destructive lifecycle command targeting unrelated consumer dependencies. The behavior is not required for a shared runtime library and is suff...

This is concrete unconsented install-time persistence, not merely an explicit user-requested startup option. The automatic cross-platform login registration and detached daemon launch jus...

The automatic postinstall hook persists a background package daemon across logins without an explicit user command. This is concrete install-hook persistence and warrants blocking despite...

The package performs unconsented install-time operating-system persistence and starts a detached daemon on future logins. No installer exfiltration was found, but the concrete persistence...

This package uses an automatic npm lifecycle hook to establish cross-platform login persistence. The behavior is concrete and does not require the user to invoke the documented startup co...

Although it has no automatic npm install hook, the explicitly invoked CLI establishes persistent controller SSH access and prepares remote AI-command execution. The package should be bloc...

Direct source inspection confirms intentional deletion of a foreign root-level script and unsafe broad control-surface changes. These are concrete harmful behaviors despite requiring a CL...

The package performs a concrete, default extra-money collection from configured wallets to a hard-coded package recipient. The configurable opt-out and runtime notice do not remove the un...

This is concrete unconsented install-time persistence in a consumer repository, coupled with external reporting on future repository activity. The browser bundle's ordinary API traffic do...

The package performs an unconsented postinstall mutation of a consuming project's GitHub Actions configuration and establishes later network reporting. This is a concrete persistence and...

The package performs unconsented postinstall mutation of a consumer repository and installs persistent workflow code that reports repository metadata externally. This is concrete unwanted...

The install-time hook makes an unconsented persistent change to a consumer repository and installs a workflow that reports repository metadata externally. This is concrete malicious lifec...