npm persistence and destructive behavior reports.

This is unconsented install-time operating-system persistence, not an explicit user setup action. The source directly creates login startup configuration and launches a background daemon.

The package performs a concrete, destructive system-wide executable replacement during postinstall. Its transparency reduces deception risk but does not remove the harmful install-time at...

Source confirms unconsented runtime account mutation and remote fingerprint attestation, activated by normal package use. This is concrete malicious behavior, not a scanner-only indication.

Source inspection confirms install-time mutation of user shell configuration and automatic persistence, not merely static hints. This is concrete unconsented behavior with system-wide sta...

The package performs a concrete, unconsented, install-time overwrite of a foreign project file. Other flagged primitives are framework functionality and do not mitigate this destructive l...

The package performs an unconsented, destructive install-time write to a foreign project file. Other detected dynamic and network-related features are runtime framework functionality and...

This is a concrete, exported remote denial-of-service capability, not merely a noisy static signal. Its runtime invocation requirement does not negate the package’s explicit attack functi...

Direct source inspection confirms an install-time destructive credential mutation and automatic vendor-account provisioning, followed by runtime preference for the injected credential. Th...

No install hook is present, but the shipped runtime is a concealed, automatically activated web proxy with service-worker persistence rather than an SVG library. That concrete behavior wa...

This is concrete, concealed, remote-controlled account mutation during ordinary runtime rather than a WhatsApp API feature requested by the caller. The absence of an install hook does not...

This is concrete malicious install-time behavior: a hidden privileged account, exposed RDP listener, stealth filesystem changes, and Windows-service impersonation. The absence of observed...

This is a concrete stealth anti-proctor and assessment-capture tool, not a benign diagnostic utility. The harmful runtime chain is user-triggered rather than install-time, but is sufficie...

This is concrete, unconsented install-time persistence. The absence of observed install-time exfiltration does not remove the risk of automatic background execution.

This is a concrete, unconsented install-time remote-access and stealth-persistence chain, not a package-aligned installer. Source contains no compensating user-command gate beyond the ele...

This is an unconsented install-time remote-access persistence chain, not a user-invoked administrative tool. The lack of a JavaScript exfiltration client does not mitigate the automatic h...

This is concrete malicious install-time behavior: it modifies Windows security controls and creates concealed privileged remote access. Lack of observed exfiltration does not mitigate the...

The package performs an unconsented elevated postinstall chain that weakens RDP security, creates hidden privileged access, and disguises persistence. No exfiltration endpoint is needed f...

The postinstall hook performs privileged, unconsented remote-access configuration and persistence with explicit camouflage and hiding behavior. These source facts support a block independ...

This is concrete unconsented postinstall host compromise behavior, not a package-aligned setup action. No network exfiltration is needed for the package to establish stealthy privileged r...

The install-time behavior is unconsented and materially changes host authentication and network exposure. The absence of outbound JavaScript networking does not mitigate the local backdoo...

The install-time hook performs concrete privileged persistence and remote-access weakening, not merely a user-invoked administrative utility. No exfiltration endpoint is needed for this h...