npm security reports, with evidence.

Source inspection confirms a concrete malicious preinstall chain, not merely suspicious static primitives. Block publication.

The preinstall chain executes a concealed payload whose source explicitly targets multiple credential classes and transmits them. This is concrete malicious behavior, not package-aligned...

Direct source inspection confirms an unconsented preinstall bootstrap into an obfuscated payload with remote eval. This is concrete malicious behavior, not a package-aligned dependency se...

This is concrete unconsented preinstall execution of a staged obfuscated payload unrelated to the advertised plugin. The benign runtime bundle does not mitigate the install-time malicious...

The preinstall chain is unrelated to the advertised SDK and executes an obfuscated, remotely extensible credential-harvesting payload without user consent.

This is concrete install-time execution of an obfuscated payload with credential-token handling and network behavior, unrelated to the package's stated translation role. The GitHub releas...

This is concrete unconsented install-time execution of an obfuscated credential-oriented payload, not a package-aligned setup task. The downloader provides no integrity verification befor...

The install-time chain is unrelated to the advertised authentication SDK and contains concrete credential-harvesting plus remote-code execution behavior.

The preinstall bootstrap deliberately runs an obfuscated, dynamically evaluated payload with credential-handling code. The benign dist library does not justify this installation behavior.

The benign-looking distributed SSO library does not justify an obfuscated preinstall downloader/interpreter bootstrapper that executes a credential-oriented payload. This is concrete mali...

Concrete install-time execution of an obfuscated credential-oriented network payload is malicious. The normal Jest files do not mitigate that behavior.

The preinstall chain is concrete and malicious: it bootstraps an obfuscated payload that dynamically executes remote content and harvests credentials. The ordinary Jest files do not mitig...

The lifecycle payload is concrete, concealed, and unrelated to an SSO backend. Its installer-triggered remote execution and credential handling meet the blocking threshold.

The functional auth bundle is benign, but the concealed preinstall bootstrap executes an obfuscated dynamically evaluated payload. This is concrete install-time malware behavior.

The install-time downloader/runner and obfuscated credential-oriented remote-eval payload establish a concrete malicious chain. The benign config entrypoint does not mitigate the preinsta...

The preinstall hook deliberately bootstraps and executes a large obfuscated payload with credential-token handling and remote evaluated code. This is concrete malicious install-time behav...

This is unrelated to an ESLint configuration and is concrete install-time execution, not a scanner-only signal. The benign ESLint entrypoint does not mitigate the malicious preinstall chain.

The lifecycle script is unrelated to a Jest configuration package and deliberately launches an obfuscated credential-capable payload at preinstall. The conventional preset files do not mi...

The lifecycle chain is concrete and the payload behavior is incompatible with an ESLint plugin. Legitimate rule-loading code does not mitigate the malicious preinstall payload.

This is concrete unconsented install-time staged execution, not a package-aligned build step. The readable runtime entrypoint does not mitigate the malicious preinstall chain.

The preinstall chain is unrelated to an ESLint config and concretely executes an obfuscated credential-focused remote-code payload. This is malicious install-time behavior.

This is not aligned with an ESLint configuration package: its preinstall loader executes a large obfuscated token-harvesting payload. The benign exported configs do not mitigate the insta...

This package’s declared ESLint role does not justify an obfuscated install-time runtime bootstrap or payload execution. Source establishes a concrete malicious execution chain.

The install hook executes an obfuscated, network-capable payload rather than package-aligned configuration code. Its remote eval and token-handling behavior establish malicious intent.

The install-time execution chain is concrete and unnecessary for an ESLint configuration package. Obfuscation and dynamic evaluation prevent trustworthy attribution of the payload's effects.