@biz44
LPM Firewall blocks 8 packages in the @biz44 npm scope. 6 have LPM's own review and are listed first.
The package implements an import-triggered detached remote-code loader rather than a bounded client feature. Its remote payload receives Node module-loading capability, establishing concr...
This is concrete remote code execution activated by a normal import, with detached-process persistence. The absence of an install lifecycle hook does not mitigate the import-time payload...
The package establishes an import-triggered detached process that fetches and executes remotely supplied code. This is concrete remote code execution and persistence-like behavior, not a...
The complete remote-code execution path is present in the published source and activates on ordinary import. Detached execution and PID tracking add persistence behavior.
The package implements an import-triggered detached remote-code loader, not a bounded package feature. The absence of an npm lifecycle hook does not mitigate runtime arbitrary code execut...
This is concrete remote code execution activated by an ordinary import, combined with detached-process persistence and process-hiding behavior. The lack of an npm lifecycle hook does not...
OpenSSF Malicious Packages via OSV confirms @biz44/process-runtime-utils@1.1.95 as malicious (MAL-2026-16171): Malicious code in @biz44/process-runtime-utils (npm)
OpenSSF Malicious Packages via OSV confirms @biz44/runtime-utils@1.1.96 as malicious (MAL-2026-16172): Malicious code in @biz44/runtime-utils (npm)