npm remote execution reports, with evidence.

The package executes a remotely fetched binary during postinstall, with release selection and checksum material both controlled by the same external source. This establishes a concrete in...

This package performs unconsented install-time remote native-code acquisition with a caller-controllable source and non-independent integrity check. That forms a concrete postinstall remo...

The package contains a concrete, obfuscated staged-payload loader that executes unvalidated cached code. Its inert postinstall hook does not mitigate the runtime arbitrary-code-execution...

This is concrete unconsented install-time remote payload execution, not merely a user-invoked setup feature. Opt-in shared-path migration does not mitigate the default remote installer an...

Direct source inspection confirms immediate, non-user-invoked reverse-shell behavior in the runtime entrypoint. Absence of lifecycle hooks does not mitigate import-time remote command acc...

The exported runtime behavior is an unauthenticated remote payload loader and executor, unrelated to the stated trading utility purpose. Lack of lifecycle hooks limits activation to API u...

This is a concrete install-triggered C2 and remote-control chain, not merely a bundled desktop application. The lifecycle hook runs it without an explicit user command.

The package has a concrete unconsented postinstall remote-code-execution chain. Vendor-named endpoints and opt-outs do not remove the install-time execution risk.

This is a concrete staged remote-code-execution path, not a benign CDN fetch: server-controlled content is dynamically executed with privileged Node globals. Absence of lifecycle hooks li...

This is a concrete remote-code-execution loader, not a benign network helper: untrusted network content is executed directly with Node capabilities. Lack of automatic invocation limits th...

The lifecycle hook performs an unconsented, mutable remote payload fetch and executes installation commands derived from it. This is a concrete install-time remote-code-execution supply-c...

The source implements a concrete staged remote-code-execution path, despite requiring an explicit exported-function call. Its declared utility purpose and documentation do not justify thi...

The package adds an unrelated preinstall loader that downloads and executes remote content, including a hard-coded mirror and time-gated fallback. This is concrete install-time remote cod...

The runtime entrypoint contains an explicit remote download-and-execute chain, corroborated by a bundled file that invokes it. Absence of an install hook does not mitigate this concrete r...

The source contains a concrete, reachable remote download-and-execute chain. Absence of an install hook limits automatic activation but does not remove the malicious runtime payload.

This is a concrete install-time remote native-payload chain with explicit security-control evasion and per-user OS integration. A bundled hash check does not independently establish trust...

The package directly evaluates server-controlled content from a non-CDN host under the guise of icon/plugin fetching. Absence of install-time execution limits the trigger but does not rem...

This is a concealed staged remote-code-execution chain in a package presented as an SVG utility. It is reachable through documented runtime APIs, despite no install hook in this package's...

Source inspection confirms a reachable remote-download-to-shell execution chain with no legitimate package functionality evident. Absence of lifecycle hooks limits automatic activation bu...

This is a concrete remote-code-execution chain, not merely a dynamic-evaluation primitive. Lack of install hooks limits automatic activation but does not remove the malicious runtime payl...