npm remote execution reports, with evidence.

This is a concrete import-time remote code execution chain unrelated to the stated pluggable owners interface. Absence of npm lifecycle hooks does not mitigate execution when consumers im...

This is a concrete import-time staged-payload execution chain unrelated to the documented header library. The absence of an npm lifecycle hook does not mitigate arbitrary execution when c...

This is an import-time staged native payload execution chain unrelated to the package’s stated framework purpose. The absence of an npm lifecycle hook does not mitigate execution on norma...

This is concrete import-time remote payload staging and execution, with obfuscated fallback infrastructure and throttling. Absence of an npm lifecycle hook does not mitigate the reachable...

This is a concrete import-time remote payload execution chain unrelated to the package's documented menu API. The package is malicious even though it has no npm lifecycle hook.

The package’s advertised authentication API has no legitimate need for an import-time, unverified remote binary downloader and detached executor. This is a concrete arbitrary-code executi...

This is a concrete staged payload chain reachable on ordinary import, not a configured telemetry feature. No lifecycle hook is needed because the malicious action runs from the main entry...

The advertised feature-toggle entrypoint has no need for an import-time remote binary bootstrap. The concrete downloader-to-temp-file-to-detached-execution chain is malicious.

This is a concrete, automatically reachable remote binary staging and execution chain concealed behind an unrelated DI package API. The absence of lifecycle scripts does not mitigate impo...

Direct source inspection confirms an import-time staged-payload downloader and detached executor, not merely telemetry transport. The lack of lifecycle hooks does not mitigate execution o...

The package's documented auth API is unrelated to its import-time remote binary loader. No lifecycle script is needed because ordinary package import triggers the execution chain.

This is a concrete import-time remote code execution chain, not legitimate telemetry. The large telemetry module contains a parallel implementation, reinforcing deliberate payload-loader...

This is a concrete import-time staged payload execution chain unrelated to the advertised cobrowsing interface. The lack of install hooks does not mitigate execution when consumers import...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The included telemetry module independently contains the same remote native-loader pattern.

Source directly establishes import-time remote payload retrieval and execution; no lifecycle hook is needed for the attack to trigger. The benign exported wrapper and lack of declared dep...

This is a concrete import-time staged-payload execution chain unrelated to the stated error-boundary library. Lack of lifecycle hooks does not mitigate execution when consumers import the...

Source directly establishes an import-time remote payload execution chain. The absence of an install lifecycle hook does not mitigate execution when the package is used.

The import-time remote payload execution chain is concrete and independent of install hooks. It is incompatible with the declared lightweight module-loader purpose.

Direct source inspection confirms an import-time staged payload loader with remote native execution. The absence of lifecycle scripts does not mitigate execution through the package main...

The package entrypoint reaches a concealed remote binary downloader and detached executor during import. No user action, configuration, integrity verification, or legitimate notifier func...

The package has a concrete import-time remote-code-execution chain with no consent, verification, or package-aligned purpose. Lack of npm lifecycle hooks does not mitigate this runtime tr...