npm security reports, with evidence.

The documented UI SDK is bundled in dist/, but an unrelated preinstall hook bootstraps and executes a large obfuscated payload with remote evaluation and credential-harvesting behavior. T...

Concrete install-time execution chains into an obfuscated credential collection and exfiltration payload. The normal SDK bundle does not justify this behavior.

The lifecycle hook is not package-aligned: it stages a runtime solely to execute an opaque payload absent from the normal library entrypoint. This is concrete install-time remote-code and...

The benign public entrypoint is decoupled from a malicious preinstall path. Obfuscation, runtime bootstrapping, token handling, and remote eval are concrete install-time attack behavior.

Source inspection confirms a concrete, unconsented preinstall bootstrapper executing an obfuscated payload that evaluates remotely supplied code. This is malicious behavior, not a package...

The benign Babel entrypoint is accompanied by an unrelated install-time bootstrap that executes a concealed payload. The payload's credential handling and remote eval establish concrete m...

The package's legitimate entrypoint is trivial, while its unconsented preinstall executes a large obfuscated payload with credential and network capabilities. This is concrete malicious i...

The install hook is unrelated to the declared Babel plugin and actively stages an obfuscated executable payload. Source inspection confirms concrete credential and dynamic-code behavior.

The install hook is a concealed loader for an obfuscated payload with credential-related behavior and remote code evaluation. This is concrete malicious install-time execution, not functi...

The concrete preinstall chain into an obfuscated credential-aware payload that evaluates remote content is malicious behavior, not a package-aligned bootstrap.

The preinstall chain executes an opaque, unrelated payload and dynamically evaluates network-delivered code. This is concrete malicious install-time behavior, not a package-aligned build...

This is concrete install-time execution of an obfuscated credential-stealing payload, not a package-aligned build helper. The bootstrapper makes execution occur without a user command.

Source inspection confirms a concealed, credential-oriented payload executed automatically at npm preinstall. The normal module is only a static string export, so the installer behavior i...

The preinstall hook executes an obfuscated credential-harvesting payload unrelated to the Slate React library. Normal editor code in dist does not mitigate the install-time compromise.

The preinstall loader and obfuscated payload establish concrete malicious behavior, not merely suspicious primitives. The calendar bundle does not justify this install-time execution chain.

The install-time payload is unrelated to a CSS-modules loader and combines obfuscation, token harvesting, remote communication, and dynamic evaluation. This is concrete malicious behavior...

The install hook is unrelated to the advertised UI library and deliberately bootstraps an obfuscated credential-capable payload. Benign source entrypoints do not mitigate install-time com...

The explicit preinstall chain executes an obfuscated payload that evaluates remotely fetched content. This is concrete malicious install-time behavior, not package-aligned component funct...

This is a concrete preinstall staged-payload chain, not a package-aligned frontend utility. The executed payload contains credential-targeting and outbound transfer logic.

This is concrete, unconsented install-time execution of an obfuscated credential-stealing payload, not package-aligned setup. The benign dist logger does not mitigate the malicious lifecy...

The unconsented preinstall bootstrap and concealed obfuscated payload form a concrete malicious execution chain. The benign logger build does not mitigate lifecycle compromise.

Concrete preinstall execution, obfuscated dynamic evaluation, and credential-handling logic establish malicious behavior; the visible package purpose does not require this payload.

The package contains a concrete, unconsented install-time credential-harvesting chain, concealed behind an obfuscated payload and external runtime bootstrap. Its legitimate loader entrypo...

Source inspection confirms a concrete malicious preinstall chain, not merely suspicious static primitives. Block publication.

The preinstall chain executes a concealed payload whose source explicitly targets multiple credential classes and transmits them. This is concrete malicious behavior, not package-aligned...