Credential exfiltration in npm packages.
These packages collect secrets such as npm tokens, cloud keys, SSH keys, environment variables or local credential files and send them to a destination the user did not authorize.
Packages — page 8
453 packages with LPM's own review, newest scan first. Showing 337–384.
The malicious preinstall chain executes an obfuscated payload with credential-oriented and network behavior. The legitimate bundled component code does not justify it.
Source inspection confirms a concealed, dynamically evaluated payload executed automatically at install time, with GitHub credential-token handling. This is concrete malicious behavior, n...
The lifecycle hook is unrelated to a React UI library and deliberately stages an obfuscated payload. Direct source inspection confirms credential collection and remote content evaluation.