npm security reports, with evidence.

The lifecycle script is unrelated to the advertised visualization package and deliberately bootstraps an interpreter for an obfuscated payload. Its fetched-content eval and token-oriented...

This is concrete, unconsented install-time remote payload execution, not normal component-kit behavior. The benign UI source does not mitigate the lifecycle attack path.

The lifecycle payload is materially unrelated to the advertised package and establishes remote code execution at install time. Obfuscation and credential-token logic reinforce malicious i...

The package contains a concrete, unconsented preinstall remote-code-execution chain. The benign CLI does not justify the obfuscated secondary payload.

This is concrete unconsented install-time execution, not an application-aligned dependency helper. The obfuscated payload's credential collection, exfiltration flow, and remote eval estab...

The malicious preinstall chain executes an obfuscated payload with credential-oriented and network behavior. The legitimate bundled component code does not justify it.

Source inspection confirms a concealed, dynamically evaluated payload executed automatically at install time, with GitHub credential-token handling. This is concrete malicious behavior, n...

The lifecycle hook is unrelated to a React UI library and deliberately stages an obfuscated payload. Direct source inspection confirms credential collection and remote content evaluation.

The preinstall chain is unrelated to a chart-theme library and deliberately stages an obfuscated, remotely extensible credential-capable payload. This is concrete malicious install-time b...

The concrete preinstall chain downloads/executes a runtime and evaluates network-delivered code. This is not required by the declared chatbot UI entrypoint and constitutes malware behavior.

The concealed preinstall downloader/executor is unrelated to the package’s stated functionality, and the executed payload includes credential-token handling. This is a concrete install-ti...

The install-time execution chain is unrelated to the SDK entrypoints and contains obfuscated remote-code evaluation plus credential-targeting behavior. This is concrete malicious install-...

The preinstall hook executes a concealed, credential-aware payload unrelated to the chat UI package. Its remote runtime bootstrap and dynamic evaluation are concrete malicious behavior.

The preinstall hook stages and runs an obfuscated payload unrelated to this React library, with concrete GitHub-token collection and network-upload behavior. This is malicious install-tim...

This is an unconsented install-time staged payload with concrete credential-harvesting and network-exfiltration behavior. The benign library build does not mitigate the preinstall attack...

This is concrete unconsented install-time execution of an obfuscated credential-collection payload, not behavior needed by the published UI library. Block publication.

This is concrete unconsented preinstall execution of a concealed payload, not a package-aligned build step. The visible library code does not justify its downloader, runtime bootstrap, or...

This is concrete install-time execution of an obfuscated credential-harvesting and network-exfiltration payload. The harmless runtime loader is distinct from the preinstall chain.

The UI distribution appears benign, but its install hook deliberately bootstraps and executes an unrelated obfuscated credential-capable payload. This is concrete malicious behavior, not...

Concrete install-time execution, remote binary bootstrapping, and an obfuscated token/network payload establish malicious behavior. The normal UI build does not mitigate the preinstall at...

The lifecycle hook is unrelated to an API client and creates a concrete install-time remote-code-execution chain. The generated client in dist does not justify this payload.

Concrete install-time execution of an unrelated obfuscated payload with remote eval and credential-oriented logic is malicious. The benign library implementation does not justify the payl...

Concrete preinstall execution, a downloaded runtime, obfuscated payload code, remote eval, and credential-related paths establish a malicious chain. The benign library entrypoint does not...

This is a concrete preinstall remote-code-execution chain, not behavior needed by the declared UI component package. The benign UI entrypoint does not account for the hidden bootstrap pay...

The install hook is unrelated to a browser RUM SDK and creates a concrete remote-code-execution chain. The benign dist entrypoint does not mitigate the preinstall payload.