npm remote execution reports, with evidence.

The package contains a concealed, automatic remote binary loader reached from its main entrypoint. No lifecycle hook is needed because normal package import triggers execution.

Source directly establishes import-time remote binary retrieval and detached execution; no benign package function requires this behavior. The absence of lifecycle hooks does not mitigate...

The package has no install hook, but its normal import path performs an unconsented remote-binary download and execution chain. The telemetry naming and opt-out variables do not make this...

This is a concrete import-time remote-code-execution chain disguised as telemetry/profiling support. The same download-and-execute primitive is also present in lib/telemetry.js.

The package’s exported abstraction does not require native payload retrieval or detached execution. Source establishes an automatic, stealthy remote payload execution path.

This is a concrete import-time remote-payload execution chain, not normal telemetry. The absence of lifecycle scripts does not mitigate execution when consumers import the package.

The package's simple data-table API does not require binary downloading or execution. Source confirms the dangerous chain is import-time, concrete, and not merely a scanner label.

This package’s documented timeline API is inert, while its import-time side effect is a concealed cross-platform downloader and executor. The lack of lifecycle hooks does not mitigate run...

The package’s normal import path performs stealthy remote payload retrieval and execution, with no user action or documented need. Obfuscated endpoint construction, DNS fallback, temporar...

This is a concrete import-time remote payload download-and-execute chain unrelated to the stated declaration-generator functionality. The lack of lifecycle hooks does not mitigate executi...

This is concrete import-time staged payload execution with obfuscated endpoints and no payload verification. The absence of lifecycle hooks does not mitigate execution during ordinary pac...

The public entrypoint reaches a concealed remote binary downloader and detached launcher without user action. The lack of lifecycle hooks does not mitigate the import-time execution path.

The documented package role is a configuration loader, but its import path immediately performs covert remote native payload execution. This is concrete malware behavior, not a benign tel...

The import-time loader establishes a concrete remote-payload execution chain. The unused telemetry module contains materially similar downloader/executor logic, reinforcing intent.

The loader is reachable directly from index.js and its binary download-and-execute chain is incompatible with the package's documented lightweight React-query wrapper purpose.

The package's main entrypoint activates an obfuscated downloader/executor during ordinary import. Its fallback channels, temporary persistence marker, hidden errors, and detached executio...

This is an import-time remote payload execution chain unrelated to the tiny advertised REST-client API. Its obfuscation, DNS fallback, hidden temp staging, and detached execution establis...

This is a concrete import-time remote-code-execution chain unrelated to the advertised React hooks API. The absence of lifecycle scripts does not mitigate automatic execution when consume...

Source directly establishes an import-time remote payload download and detached execution chain. The lack of an install hook does not mitigate runtime arbitrary code execution when consum...

The package has a concrete, import-time remote-code-execution chain unrelated to its stated mobile SDK API. No install hook is needed for the payload to execute when the module is loaded.

This is a concrete import-time remote-code-execution chain unrelated to the advertised React UI components. Absence of an npm lifecycle hook does not mitigate runtime import execution.