npm advisory reports, with evidence.

This is concrete, automatic install-time collection and external transmission of host data. The behavior is not needed for the declared package and constitutes malicious data exfiltration.

The package is an obfuscated, remotely directed browser redirector presented as a security challenge. This is concrete deceptive traffic-routing behavior, not a package-aligned application.

This is an active, obfuscated browser redirect and visitor-data forwarding payload with no stated package functionality. It is not normal npm package behavior and conceals its remote dest...

The primary entrypoint performs an unconditional network beacon containing local host and user metadata to a third-party endpoint. This is concrete data exfiltration, even though the brok...

Automatic install hooks exfiltrate host and username data to an unrelated external endpoint. The behavior is concrete and active, so the package should be blocked.

The package has a concrete automatic postinstall exfiltration path to an unrelated webhook endpoint. The collected host and user metadata is sent without user interaction or package-align...

The package has an automatic postinstall beacon that exfiltrates local system and project metadata to a third-party endpoint. This is concrete malicious install-time data collection.

The package actively implements concealed, challenge-gated remote redirection in its only payload. Its opaque implementation and lack of legitimate package behavior support blocking it as...

The package contains an automatic lifecycle hook that implements remote interactive command execution. This is malicious install-hook abuse.

The package contains a preinstall hook that executes a shell-based external request. This is concrete install-hook abuse with no package functionality supporting it.

The package's only entrypoint is a heavily obfuscated challenge-and-redirect page with a concealed remote host resolution flow. Its random package identity and lack of legitimate library...

The package contains a concealed browser-redirect mechanism behind a challenge-themed page, which is concrete deceptive behavior. Although it has no install hook, the active entrypoint is...

This is concrete, automatic install-time credential and system-data exfiltration to an unrelated Telegram endpoint. The package should be blocked.

The package implements an automatic install-time reconnaissance and external callback chain. Its research labels do not establish consent for this behavior.

The package performs automatic install-time host and environment reconnaissance followed by external transmission. Its research labeling does not establish consent for this behavior.

Automatic lifecycle execution performs unsolicited host and project reconnaissance and transmits it externally. The package's research claim does not remove this concrete install-time exf...

Automatic install-time host reconnaissance and covert transmission to hard-coded external endpoints are concrete malicious behavior. Error suppression and a DNS fallback reinforce the int...

This is concrete, unconsented install-time data exfiltration with redundant network channels. The package's research label does not neutralize the automatic behavior.

The automatic lifecycle hooks activate host and environment reconnaissance and transmit the results to an unrelated external Telegram recipient. The behavior is concrete install-time data...

This is concrete install-time host reconnaissance and outbound exfiltration to an unrelated Telegram recipient. The automatic lifecycle hook makes the behavior unconsented.

The source implements deceptive process disguise, persistence, covert screen capture, and external transmission rather than the advertised DOM diagnostic function. These concrete behavior...