npm security reports, with evidence.

This is concrete, unconsented preinstall execution of an obfuscated credential-harvesting payload, not functionality aligned with a React web SDK.

This is concrete malicious install-time behavior, not package-aligned SDK functionality. The payload is automatically executed by preinstall and contains both credential collection and re...

Direct source inspection confirms an install-triggered downloader/executor feeding an obfuscated script with remote eval and credential handling. This is concrete malicious behavior, not...

This behavior is unrelated to a React web SDK and is automatically triggered before installation completes. The obfuscated remote-eval payload establishes a concrete malicious chain.

This is not package-aligned SDK behavior: the install hook bootstraps an unpinned executable to run obfuscated code that evaluates fetched content and targets credentials. The concrete pr...

This is concrete install-time execution of an obfuscated credential-oriented remote-code payload, not functionality aligned with a React component library.

The lifecycle execution, downloaded interpreter, obfuscated payload, remote eval, and credential logic form a concrete malicious chain unrelated to documentation delivery.

This package embeds an obfuscated, remotely extensible payload behind a preinstall hook; the UI SDK bundle does not explain that behavior. The concrete installation-time remote-code-execu...

The install-time execution chain launches an obfuscated payload with remote eval and credential-exfiltration behavior. This is concrete malicious behavior, not an SDK runtime feature.

The install-time execution chain runs an unrelated, heavily obfuscated payload with credential-focused and remote-code capabilities. This is concrete malicious behavior, not a package-ali...

The benign ESLint rule is accompanied by an unrelated, obfuscated preinstall payload that downloads a runtime, executes it, and evaluates fetched code. This is concrete malicious install-...

Concrete install-time execution of an obfuscated credential-harvesting payload establishes malicious behavior. The legitimate-looking UI bundles do not mitigate the preinstall attack path.

The benign lint-rule entrypoint does not justify the preinstall bootstrap or its obfuscated token-oriented payload. This is concrete malicious install-time behavior.

The install hook executes a concealed, unrelated payload with remote eval and GitHub-token handling; this is concrete malicious behavior, not package-aligned setup.

This is concrete install-time staged execution followed by credential-harvesting behavior, not a package-aligned build step. The benign component source does not justify the hidden preins...

This is concrete unconsented install-time credential theft and remote code execution, not a package-aligned build step. The visible theme code does not justify the concealed preinstall ch...

The concealed preinstall chain executes an obfuscated token-oriented payload and is concrete malicious behavior. The visible UI source does not justify this install-time functionality.

The preinstall chain executes a concealed payload rather than package functionality, with remote eval and token handling. This is concrete malicious install-time behavior.

Concrete preinstall execution, downloader behavior, obfuscation, and runtime eval establish malicious install-time remote code execution.

The package has an unconsented preinstall chain that bootstraps a runtime solely to execute a large obfuscated, credential/network-capable payload. This is concrete malicious install-time...

The lifecycle chain concretely executes a concealed credential-oriented network payload at install time. Its behavior is unrelated to the package’s stated library functionality.

The install-time loader is unrelated to the declared chart package and creates a concrete remote-code-execution chain with credential-access capability.

The lifecycle script is unrelated to the advertised visualization package and deliberately bootstraps an interpreter for an obfuscated payload. Its fetched-content eval and token-oriented...

This is concrete, unconsented install-time remote payload execution, not normal component-kit behavior. The benign UI source does not mitigate the lifecycle attack path.

The lifecycle payload is materially unrelated to the advertised package and establishes remote code execution at install time. Obfuscation and credential-token logic reinforce malicious i...