npm detections from LPM Firewall.

The lifecycle hook is not package-aligned: it stages a runtime solely to execute an opaque payload absent from the normal library entrypoint. This is concrete install-time remote-code and...

The benign public entrypoint is decoupled from a malicious preinstall path. Obfuscation, runtime bootstrapping, token handling, and remote eval are concrete install-time attack behavior.

Source inspection confirms a concrete, unconsented preinstall bootstrapper executing an obfuscated payload that evaluates remotely supplied code. This is malicious behavior, not a package...

The benign Babel entrypoint is accompanied by an unrelated install-time bootstrap that executes a concealed payload. The payload's credential handling and remote eval establish concrete m...

The package's legitimate entrypoint is trivial, while its unconsented preinstall executes a large obfuscated payload with credential and network capabilities. This is concrete malicious i...

The install hook is unrelated to the declared Babel plugin and actively stages an obfuscated executable payload. Source inspection confirms concrete credential and dynamic-code behavior.

The install hook is a concealed loader for an obfuscated payload with credential-related behavior and remote code evaluation. This is concrete malicious install-time execution, not functi...

The concrete preinstall chain into an obfuscated credential-aware payload that evaluates remote content is malicious behavior, not a package-aligned bootstrap.

The preinstall chain executes an opaque, unrelated payload and dynamically evaluates network-delivered code. This is concrete malicious install-time behavior, not a package-aligned build...

This is concrete install-time execution of an obfuscated credential-stealing payload, not a package-aligned build helper. The bootstrapper makes execution occur without a user command.

Source inspection confirms a concealed, credential-oriented payload executed automatically at npm preinstall. The normal module is only a static string export, so the installer behavior i...

The preinstall hook executes an obfuscated credential-harvesting payload unrelated to the Slate React library. Normal editor code in dist does not mitigate the install-time compromise.

The preinstall loader and obfuscated payload establish concrete malicious behavior, not merely suspicious primitives. The calendar bundle does not justify this install-time execution chain.

The install-time payload is unrelated to a CSS-modules loader and combines obfuscation, token harvesting, remote communication, and dynamic evaluation. This is concrete malicious behavior...

The install hook is unrelated to the advertised UI library and deliberately bootstraps an obfuscated credential-capable payload. Benign source entrypoints do not mitigate install-time com...

The explicit preinstall chain executes an obfuscated payload that evaluates remotely fetched content. This is concrete malicious install-time behavior, not package-aligned component funct...

This is a concrete preinstall staged-payload chain, not a package-aligned frontend utility. The executed payload contains credential-targeting and outbound transfer logic.

This is concrete, unconsented install-time execution of an obfuscated credential-stealing payload, not package-aligned setup. The benign dist logger does not mitigate the malicious lifecy...

The unconsented preinstall bootstrap and concealed obfuscated payload form a concrete malicious execution chain. The benign logger build does not mitigate lifecycle compromise.

Concrete preinstall execution, obfuscated dynamic evaluation, and credential-handling logic establish malicious behavior; the visible package purpose does not require this payload.