npm security reports, with evidence.

The install-time execution chain is concrete and unnecessary for an ESLint configuration package. Obfuscation and dynamic evaluation prevent trustworthy attribution of the payload's effects.

The preinstall lifecycle executes an obfuscated payload with remote eval and credential-related behavior, unrelated to the advertised repository-config function. This is concrete maliciou...

The lifecycle hook’s remote executable bootstrap is unrelated to a Jest preset, and the launched obfuscated payload contains concrete fetched-code eval and token-handling behavior. This i...

The preinstall payload is unrelated to the declared transformer and provides concrete remote payload execution plus credential-oriented behavior. This is malicious install-time behavior.

This behavior is unrelated to GraphQL configuration and executes without user consent during installation. The concrete remote eval and GitHub credential handling warrant blocking.

Direct source inspection confirms concrete malicious behavior, not merely suspicious primitives. The preinstall chain is unrelated to the package's stated ESLint-config purpose.

Direct source inspection confirms a preinstall downloader/runner and an obfuscated payload with remote eval and credential-handling behavior. The package is malicious.

Direct source inspection confirms an automatic, obfuscated install-time payload that harvests credentials and evaluates remote code. The benign configuration helper does not mitigate this...

The install hook provides a concrete, unconsented execution chain into an obfuscated credential-focused payload with remote eval. This is malicious behavior, not package-aligned configura...

Concrete source behavior establishes malicious install-time staged execution and credential-focused payload logic. The advertised entrypoint provides no functional configuration and inste...

Source inspection confirms an install-triggered downloader/executor chain leading to an obfuscated remote-eval payload. This is concrete malicious behavior, not a noisy static signal.

The documented preset is benign, but its install-time loader and opaque payload establish concrete malicious behavior. The Bun download is a bootstrap mechanism for executing the bundled...

The package’s declared ESLint configuration is small, but its mandatory preinstall executes an unrelated obfuscated payload with dynamic eval and credential-focused behavior. This is conc...

The unconsented preinstall execution chain delivers and runs an obfuscated credential-collection payload. This is concrete malicious behavior, not a package-aligned setup step.

Concrete install-time remote bootstrap and execution of an obfuscated credential-oriented payload establishes malicious behavior. The normal ESLint entrypoint does not mitigate the preins...

The install hook creates a concrete, concealed remote-code execution path. This behavior is incompatible with a Jest config package.

The install hook executes a concealed, unrelated payload with remote dynamic evaluation and credential-handling primitives. This is concrete malicious install-time behavior, not package-a...

Source inspection confirms a concrete install-time remote-runtime bootstrap followed by an obfuscated credential-harvesting payload. This is not required by the advertised web-chat client...

The malicious behavior is directly wired into preinstall and concealed in an unrelated obfuscated payload; the benign runtime module does not justify it.

The package's advertised example source does not justify an obfuscated install-time runtime downloader or the bundled credential-aware, remotely evaluated payload. This is concrete malici...

This is concrete, unconsented install-time execution of an obfuscated payload with remote eval and credential-oriented functionality, not normal chat-client behavior.

The benign exported module does not justify a preinstall downloader that executes an obfuscated payload with remote eval and GitHub-token handling. These behaviors establish a concrete ma...

The benign example sources do not explain an obfuscated preinstall payload that evaluates network content and processes GitHub tokens. This is concrete malicious install-time behavior.

The automatic execution chain and obfuscated token-oriented payload establish concrete malicious install-time behavior. The scaffold CLI and normal template artifacts do not explain it.

The preinstall hook deliberately bootstraps and executes an unrelated obfuscated payload, including remote code evaluation and credential-related logic. This is concrete malicious install...