Detected presence of files with behaviors similar to malicious packages published on NPM. (x1)

Detected presence of files that collect and exfiltrate user information. (x1)

Detected presence of plaintext credentials within network protocol strings. (x3)

Detected presence of files containing URLs that use non-standard ports. (x5)

Detected presence of software components that can access user identity information. (x2)

Detected presence of files containing bidirectional Unicode control characters. (x1)