npm remote execution reports, with evidence.

The package’s advertised proxy functionality is bundled with an automatically activated, hard-coded remote administration channel that provides command execution and unrestricted file acc...

Confirmed source contains a staged remote-code-execution loader, despite no npm install hook. The deferred trigger does not reduce the concrete malicious behavior.

The postinstall hook performs external runtime provisioning and code installation, rather than merely configuring package-owned files. That is a concrete install-hook remote-payload execu...

Source inspection confirms concrete staged remote execution and detached process launch, not merely suspicious primitives. Absence of lifecycle hooks does not mitigate import-time execution.

This is a concrete remote-command and sensitive-data collection channel, not merely a local automation primitive. Lack of an install hook reduces install-time risk but does not remove the...

Source establishes an automatic remote-payload-to-execution chain with no user invocation or integrity verification. This is concrete malware behavior, not ordinary telemetry.

This is concrete import-time staged payload execution, not normal telemetry: opaque remote binaries are fetched, dropped, and executed without user action. The same behavior is also imple...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. No lifecycle hook is needed because index.js reaches the loader whenever consumers import the package.

This is a concrete, import-triggered remote code execution chain with concealed payload delivery and detached execution. The absence of npm lifecycle scripts does not mitigate the runtime...

The import-time bridge is a concrete staged malware loader, independent of npm lifecycle scripts. The telemetry module also implements a similar configurable native-extension loader.

The import-time remote download-and-execute chain is concrete source behavior, not a scanner-only inference. It is unrelated to the package's stated TypeScript-definition purpose.

Source directly confirms an automatic staged payload downloader and executor at the package entrypoint. The lack of install hooks does not mitigate runtime import-time execution.

This is a concrete import-time remote native payload execution chain, not normal telemetry. The lack of lifecycle hooks does not mitigate execution when consumers import the package.

This is a concrete import-time remote-code-execution chain with no integrity verification and concealment through fragmented strings, rotating hosts, temporary filenames, and suppressed e...

This is a concrete, import-triggered remote payload execution chain with obfuscated endpoints and no payload validation. It is unrelated to the declared API-client purpose.

The source provides a concrete, automatically reachable remote payload download-and-execute chain, not merely telemetry behavior. Lack of an install hook does not mitigate execution on no...

This is concrete, automatically reachable remote native-code execution, not telemetry functionality. Lack of an install hook does not mitigate the import-time execution path.

This is a concrete import-time remote-code-execution chain disguised as analytics/profiling. Absence of an npm lifecycle hook does not mitigate runtime execution when the package is impor...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The telemetry module contains a similarly capable configurable downloader, reinforcing the malicious pa...

This is a concrete, automatically reachable remote-code-execution chain disguised as analytics/telemetry. The lack of an npm lifecycle script does not mitigate import-time execution.