npm remote execution reports, with evidence.

The active entrypoint connects ordinary middleware initialization to concealed remote code execution. The encoded endpoint, detached execution, and unrestricted response evaluation suppor...

The inspected entrypoint directly downloads and executes a reverse-shell payload. This concrete attack behavior supports blocking despite the absence of an install hook.

Inspected source establishes automatic concealed remote executable download and execution, unrelated to environment configuration. This is an active attack, rather than an inert payload c...

Automatic execution of a hidden encoded PowerShell payload from a JPEG is concrete malicious behavior. Block publication.

This is an active concealed remote-code-execution chain, not environment configuration functionality. The import-time and CLI triggers make the payload directly reachable.

This is an automatic install-time remote-code-execution chain that persists and executes an unverified latest-release binary. It is concrete attack behavior rather than an inert downloader.

The import-time daemon and remote Function execution form an active remote-code-execution path. The cryptographic check authenticates the operator payload rather than constraining its cap...

The package performs substantial automatic system setup and starts a detached command-capable service during postinstall. The bundled service also contains an embedded credential, making...

The automatic remote-script download and evaluation path is a concrete remote code execution capability. The obfuscated bundled browser payload reinforces that this is not a transparent c...

The package contains an import-triggered, detached remote payload loader that executes server-authorized JavaScript. This is concrete remote code execution, not ordinary item validation.

The source contains an active remote command execution path combined with security-control weakening and agent configuration mutation. This is concrete malicious behavior, not a passive i...

Opaque bundled code is decrypted using remotely supplied material and actively executed through the Function constructor. This is a concrete remote code execution path, not an inert encry...

The package contains and automatically activates a hidden encoded-PowerShell launcher from both its library and CLI entrypoints. This is concrete malicious execution behavior unrelated to...

The package is a browser remote-code loader: index.html dynamically imports fetched bytes and calls boot, and sw.js importScripts a versioned CDN script. Obfuscated CDN endpoints and an e...

The Linux JDK fetch is a concrete remote-code path: an unrelated Vercel host supplies an archive that is extracted and then placed on JAVA_HOME for a later Expo command. Windows uses Adop...

The automatic lifecycle hook establishes OS persistence and activates a background worker. That worker accepts server-supplied commands for shell execution, creating a concrete remote cod...

The package contains an active remote-code loader embedded into a newly deployed Lambda function. Its opaque, service-controlled payload is executed without integrity verification.

This is an active remote-code execution path in a customer AWS function, not merely a downloadable artifact. Explicit deployment invocation does not constrain the package-controlled endpo...

The package contains an active install-time remote payload execution chain, rather than a user-invoked download. This warrants blocking because the downloaded native code is executed auto...

Importing the package runs an obfuscated loader that shells out through execSync and prepares host and username collection plus an axios send. That is concrete remote command execution hi...

The published main module immediately runs an obfuscated payload that loads shell execution, filesystem access, and an HTTP client. That is hidden import-time attack behavior, not a logge...