npm security reports, with evidence.

The preinstall hook stages and runs an obfuscated payload unrelated to this React library, with concrete GitHub-token collection and network-upload behavior. This is malicious install-tim...

This is an unconsented install-time staged payload with concrete credential-harvesting and network-exfiltration behavior. The benign library build does not mitigate the preinstall attack...

This is concrete unconsented install-time execution of an obfuscated credential-collection payload, not behavior needed by the published UI library. Block publication.

This is concrete unconsented preinstall execution of a concealed payload, not a package-aligned build step. The visible library code does not justify its downloader, runtime bootstrap, or...

This is concrete install-time execution of an obfuscated credential-harvesting and network-exfiltration payload. The harmless runtime loader is distinct from the preinstall chain.

The UI distribution appears benign, but its install hook deliberately bootstraps and executes an unrelated obfuscated credential-capable payload. This is concrete malicious behavior, not...

Concrete install-time execution, remote binary bootstrapping, and an obfuscated token/network payload establish malicious behavior. The normal UI build does not mitigate the preinstall at...

The lifecycle hook is unrelated to an API client and creates a concrete install-time remote-code-execution chain. The generated client in dist does not justify this payload.

Concrete install-time execution of an unrelated obfuscated payload with remote eval and credential-oriented logic is malicious. The benign library implementation does not justify the payl...

Concrete preinstall execution, a downloaded runtime, obfuscated payload code, remote eval, and credential-related paths establish a malicious chain. The benign library entrypoint does not...

This is a concrete preinstall remote-code-execution chain, not behavior needed by the declared UI component package. The benign UI entrypoint does not account for the hidden bootstrap pay...

The install hook is unrelated to a browser RUM SDK and creates a concrete remote-code-execution chain. The benign dist entrypoint does not mitigate the preinstall payload.

This is concrete, unconsented install-time execution of an obfuscated credential-harvesting payload, not package-aligned tooling.

This is concrete install-time execution of an obfuscated payload that targets GitHub credentials, unrelated to the published charting library. The explicit bootstrapper and payload form a...

The lifecycle chain provides concrete unconsented install-time execution of an obfuscated credential-harvesting and exfiltration payload. This is malicious, not a package-aligned dependen...

The benign title component is accompanied by an unrelated, obfuscated preinstall payload that downloads a runtime and supports remote eval and token access. This is concrete malicious ins...

The install hook is unrelated to an ESLint configuration package and launches a concealed credential-oriented payload. This is concrete malicious behavior, not a noisy static match.

This is unconsented preinstall execution of an obfuscated payload that collects and transmits GitHub credentials. The Bun download is a staging mechanism, not a package-aligned UI-library...

This is a concrete unconsented preinstall malware chain, not functionality aligned with a form UI package. The obfuscated payload directly combines credential harvesting, network exfiltra...

This is concrete malicious preinstall behavior: a web-components package downloads an interpreter to execute an unrelated obfuscated token-harvesting payload. The benign application runti...

This is concrete install-time execution of an obfuscated staged payload with credential-harvesting and upload behavior, unrelated to the advertised CLI. It warrants blocking.

This is a concrete install-time execution and credential-exfiltration chain, not a scanner-only inference.

This is concrete unconsented install-time remote payload execution, not functionality aligned with a React SDK.

The preinstall chain is unrelated to a React web SDK and deliberately launches an obfuscated payload. Source inspection confirms credential-oriented collection plus remote eval, which is...

The documented UI SDK is bundled in dist/, but an unrelated preinstall hook bootstraps and executes a large obfuscated payload with remote evaluation and credential-harvesting behavior. T...