npm remote execution reports, with evidence.

This is concrete import-time remote payload execution, unrelated to the package's stated wrapper purpose. No lifecycle hook is needed because requiring the public module activates the chain.

This is concrete automatic remote payload execution unrelated to the documented abstraction API. No install hook is needed because ordinary package import activates the chain.

The import-time downloader and detached execution chain is concrete remote code execution, unrelated to the advertised header abstraction. The telemetry-named code repeats the same payloa...

This is a concrete import-time remote-code-execution chain unrelated to the declared UI support module. The absence of npm lifecycle hooks does not mitigate execution on normal package im...

The public import path directly reaches unverified remote binary execution, unrelated to the package’s stated footer abstraction. This is concrete malware behavior, not ordinary telemetry.

This is concrete import-time remote payload execution, not package-aligned telemetry. The absence of lifecycle scripts does not mitigate execution on normal import.

This is a concrete import-time remote-code-execution chain unrelated to the declared UI-wrapper functionality. The lack of install hooks does not mitigate execution on normal package import.

Direct source inspection confirms an import-time remote payload loader and detached execution chain. The absent npm lifecycle hook does not mitigate the runtime compromise.

The import-time downloader and detached execution of unverified remote bytes are concrete malicious behavior, not telemetry. Lack of an npm lifecycle hook does not mitigate the runtime im...

The entrypoint-triggered loader provides a concrete remote code execution chain with no user action beyond importing the package. Its hidden network endpoints, temporary binary drop, and...

The package's advertised API is inert, while its unconditional import side effect implements an obfuscated remote executable loader. Absence of lifecycle hooks does not mitigate this runt...

The documented API is a minimal wrapper, while the import-time bridge implements a hidden remote binary loader and executor. This is malicious despite the absence of npm lifecycle hooks.

This is a concrete import-time staged-payload execution chain unrelated to the declared fonts functionality. Absence of lifecycle hooks does not mitigate the automatic runtime trigger.

This is a concrete import-time remote payload execution chain, unrelated to the stated package functionality. The lack of lifecycle hooks does not mitigate execution when an application i...

This is a concealed import-time remote code execution chain unrelated to the stated button-wrapper functionality. No install hook is needed because package consumption triggers the loader.

The package contains a concrete, import-reachable remote payload download-and-execute chain with obfuscated endpoints. This is malware, not package-aligned telemetry.

This is concrete import-time staged remote-code execution unrelated to the claimed slider functionality. Absence of an npm lifecycle hook does not mitigate execution when consumers import...

The malicious behavior is source-confirmed and reachable on ordinary import, despite no install lifecycle hook. The large telemetry module reinforces the same staged executable pattern.

The import-time remote binary staging and detached execution chain is concrete and requires no caller opt-in. The unused telemetry module contains a similar configurable loader, reinforci...

This is a concrete import-time staged payload loader and arbitrary code execution chain, unrelated to the advertised wrapper functionality. Absence of an npm lifecycle hook does not mitig...

This is a concrete import-time remote payload execution chain unrelated to the advertised component package. The unreferenced telemetry module contains substantially similar native-payloa...