npm remote execution reports, with evidence.

This is concrete, unconsented install-time remote binary execution with no independent authenticity verification. The lifecycle guard does not mitigate the risk for normal npm installs.

The package embeds an undisclosed external script and an obfuscated fetch-plus-new-Function loader activated by opening its page. This is a concrete remote code execution surface, not mer...

The package performs concealed import-time remote payload execution unrelated to its declared text-helper functionality. This is concrete malware behavior.

This is concrete install-time malware, not a package-aligned diagnostic feature: it establishes remote command execution, persistence, and internal credential/service reconnaissance.

The package’s main functionality and runtime security controls appear package-aligned, but the unconditional postinstall remote-script execution is a concrete, unconsented install-time RC...

The package hides a remote payload downloader and detached interpreter execution behind its advertised API. No lifecycle hook is needed for this consumer-triggered malicious execution path.

The package implements an immediate remote-payload loader and dynamic evaluator with no integrity check, user action, or package-aligned functionality. This is concrete remote code execut...

The package contains an unconsented install-time remote code-execution chain. Its runtime safeguards do not mitigate this lifecycle behavior.

The package performs unconsented install-time remote payload execution and writes remotely acquired agent skills. This is a concrete supply-chain execution surface, not merely a user-invo...

The package has a concrete, default postinstall remote-payload execution chain and stages unpinned externally fetched skills for activation. Opt-in protection for shared-path migration do...

The postinstall hook executes a remotely supplied shell script whose archive and checksum share the same mutable trust source. This is a concrete install-time remote-code-execution chain,...

This is a concrete remote-code-execution loader disguised as a Tailwind plugin. Absence of an install hook limits the trigger but does not mitigate execution when the exported plugin is u...

The import-time updater silently installs a mismatched remote package into the caller's project. This is concrete unconsented remote code execution behavior, not a normal user-invoked upd...

The payload executes on package import and has a concrete network-to-eval-to-detached-process chain. The absence of lifecycle hooks does not mitigate import-time arbitrary code execution.

Direct source inspection confirms an unconsented install-time reverse shell with a hard-coded command-and-control endpoint. The benign date formatter does not justify this behavior.

The package deliberately hides an auto-running browser loader that remotely retrieves and evaluates code. Its lack of an install hook reduces install-time scope but does not remove the co...

The source implements an obfuscated remote-code loader with automatic browser activation. Absence of lifecycle hooks limits install-time impact but does not remove the concrete runtime RC...

The package contains a concealed remote code loader whose downloaded response is directly executed. Although it has no install hook, this is a concrete arbitrary-code execution surface fo...

The appended import-time payload is unrelated to a Tailwind forms plugin and contains concrete obfuscated staging, eval, and detached process execution. The lack of lifecycle hooks does n...

The package contains a concrete remote-code-execution chain, albeit behind an explicit command rather than install-time execution. This is maliciously unsafe distribution behavior because...

This is concrete malicious runtime behavior unrelated to mutex functionality, including host reporting and remote code execution. Absence of lifecycle hooks does not mitigate the callable...