Credential exfiltration in npm packages.
These packages collect secrets such as npm tokens, cloud keys, SSH keys, environment variables or local credential files and send them to a destination the user did not authorize.
Packages — page 9
453 packages with LPM's own review, newest scan first. Showing 385–432.
The package contains a concrete, automatic npm-token exfiltration chain in its preinstall hook. The benign arithmetic entrypoint does not mitigate this behavior.
Source confirms a credential-bearing endpoint redirection, not merely a benign setup helper. The lack of an install hook does not remove the concrete credential-exfiltration chain trigger...
This is concrete import-time malware execution, not calendar functionality or a scanner-only signal. The concealed native payload provides credential theft and exfiltration capabilities.