npm persistence and destructive behavior reports.

The implementation's unrestricted recursive deletion contradicts its cache-cleanup description. The remote authorization gate adds covert control over a destructive payload.

This package presents itself as cache cleanup but implements remote-controlled deletion of an entire project directory. The explicit-call requirement reduces automatic exposure but does n...

This is a destructive payload disguised as cache cleanup: it removes arbitrary project contents after remote authorization. The absence of an install hook limits automatic execution but d...

Although it has no automatic npm install hook, the explicitly invoked CLI establishes persistent controller SSH access and prepares remote AI-command execution. The package should be bloc...

This is concrete import-time malware, not a user-invoked library feature. It downloads remote code, executes it hidden, and establishes persistence.

This is concrete import-time malware behavior: covert remote payload execution and multi-method Windows persistence unrelated to Discord MFA. The absence of an npm lifecycle hook does not...

The package contains a concrete import-time denial-of-service path aimed at CI and sandbox environments, plus concealed dynamic loading. These behaviors are not required for the documente...

Source confirms unconsented runtime account mutation and remote fingerprint attestation, activated by normal package use. This is concrete malicious behavior, not a scanner-only indication.

This is concrete, concealed, remote-controlled account mutation during ordinary runtime rather than a WhatsApp API feature requested by the caller. The absence of an install hook does not...

The install hook performs unrelated host-data collection, external-path mutation, and detached-process creation without user consent. These concrete install-time behaviors warrant blockin...

The delayed import-time network fetch and hidden remote-config write are concrete, nonessential attack behavior. No lifecycle hook is required because normal module use triggers it.

The package establishes a persistent system service during postinstall and hides the implementation with heavy obfuscation. This is concrete malicious install-time persistence.

The malicious actions are directly reachable from an npm postinstall hook and require no user invocation. They combine secret exfiltration, remote-controlled host scanning, and SSH persis...

The documented package is calendar/streak math, but its primary entry contains a concealed import-time downloader, detached executable launch, and persistence mechanism. The environment g...

This is an import-time, targeted downloader/executor with stealth persistence, unrelated to calendar or streak math. Absence of an npm lifecycle hook does not mitigate the concrete runtim...

The hidden import-time download, executable extraction, and Startup-folder persistence are concrete malware behavior unrelated to streak math. No lifecycle hook is needed because the payl...

The package establishes stealthy remote payload delivery and login persistence during ordinary import. Absence of an npm lifecycle hook does not mitigate this concrete runtime attack path.

This is a concrete remote payload and persistence mechanism unrelated to calendar/streak functionality. Absence of an npm lifecycle hook does not mitigate import-time execution.

The package's calendar utilities do not justify an import-time hidden executable drop into the Windows Startup folder. This is concrete persistence behavior despite having no npm lifecycl...

The import-time hidden download and placement of a remote executable in a Windows Startup folder is concrete persistence behavior. Absence of an npm lifecycle hook does not mitigate runti...

The package contains an import-time remote binary dropper targeting a foreign Windows Startup persistence surface. The benign calendar API does not justify this behavior.