npm detections from LPM Firewall.

This is concrete, unconsented install-time collection and exfiltration of local host data to an unrelated external endpoint.

This is concrete, unconsented install-time system-information exfiltration, explicitly framed as a dependency-confusion proof of concept. The source directly establishes the behavior.

Source confirms unconsented install-time host-data exfiltration to an external endpoint. This is concrete malicious behavior, not a scanner-only inference.

Direct source inspection confirms unconsented install-time collection and external transmission of host data. This is concrete malicious behavior, not merely a suspicious primitive.

Direct source inspection confirms an install-time host-fingerprinting and external exfiltration chain. The nested archive contains the same package source and does not mitigate this behav...

Direct source inspection confirms unconsented install-time host fingerprint exfiltration. This is concrete malicious behavior, not an inert test artifact.

Direct source inspection confirms unconsented install-time host fingerprint exfiltration. The nested archive contains the same manifest and source pattern.

Source directly confirms unconsented install-time host fingerprint exfiltration. The nested archive contains the same malicious manifest and script.

Source directly confirms unconsented install-time host fingerprinting and external exfiltration. The package description also identifies it as a dependency-confusion proof of concept.

Direct source inspection confirms unconsented install-time collection and exfiltration of host fingerprint data. This is concrete malicious behavior, not merely a static indicator.

The package performs unconsented install-time fingerprint exfiltration and explicitly identifies itself as a dependency-confusion proof of concept. No benign functionality offsets this co...

The package contains concrete, unconditional remote-code execution at import time. Its inert-canary documentation is contradicted by the source.

This is an import-time, targeted downloader/executor with stealth persistence, unrelated to calendar or streak math. Absence of an npm lifecycle hook does not mitigate the concrete runtim...

Despite inert-canary comments, the source contains concrete import-time remote code execution. No install hook is needed for this to be malicious.

The package has no install hook, but its exported main file creates concrete remote code execution whenever it is imported. The source comment falsely describes the package as inert.

Direct source inspection confirms unconsented install-time host-data exfiltration to an external endpoint. This is concrete malicious behavior, not a scanner-only signal.

Direct source inspection confirms an install-time host-fingerprinting exfiltration chain. The declared dependency-confusion proof-of-concept description reinforces malicious intent.

Direct source inspection confirms unconsented install-time host-data exfiltration. The nested archive contains the same manifest and script.

This is concrete, unconsented install-time host-data exfiltration, corroborated directly in the manifest and source.

Source directly confirms unconsented install-time collection and exfiltration of host-identifying data. This is concrete malicious behavior, not a benign package-aligned network action.

Direct source inspection confirms unconsented install-time exfiltration and remote-access persistence. This is concrete malicious behavior, not a package-aligned feature.