npm remote execution reports, with evidence.

Source establishes an import-time remote payload download-and-execute chain. The absence of an npm lifecycle hook does not mitigate the reachable runtime execution.

This is a concrete import-time staged payload delivery and execution chain, unrelated to the declared infrastructure-utilities package purpose. Absence of an install hook does not mitigat...

The package implements an import-triggered remote payload execution chain with stealthy temporary files, detached processes, and fallback infrastructure. This is concrete malicious behavi...

The entrypoint creates an import-time remote binary downloader and detached executor; this is concrete malware behavior despite no install lifecycle hook.

Source inspection confirms a reachable, automatic downloader-and-executor with no user opt-in. The lack of an npm lifecycle hook does not mitigate execution when consumers import the pack...

The concrete import-time staged payload chain is independently confirmed in source. Absence of an npm lifecycle hook does not mitigate execution on normal package use.

The package contains a concrete remote-payload execution chain, not merely a dynamic-evaluation primitive. Although it is user-invoked rather than install-time, the hard-coded external lo...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry behavior. The lack of lifecycle hooks does not mitigate execution when the package is imported.

The package performs concealed remote payload retrieval and execution during ordinary import, without a user-invoked setup action. This is concrete malware behavior despite the absence of...

The package contains concrete import-time, unverified remote binary execution rather than telemetry-only behavior. The lack of install hooks does not reduce the runtime RCE risk.

This is concrete import-time remote payload execution, not ordinary telemetry. No install hook is needed because requiring the advertised package entrypoint triggers the behavior.

This is a concrete import-time remote payload execution chain, unrelated to the stated data-transformation purpose. The absence of lifecycle scripts does not mitigate execution on normal...

This is a concrete, automatically triggered remote payload execution chain unrelated to the declared UI-helper package purpose. No install hook is needed because the malicious behavior ex...

The import-time downloader and detached execution chain is concrete and does not require a lifecycle hook. The telemetry naming and opt-out variables do not mitigate arbitrary remote bina...

This is a concrete import-time remote native payload execution chain unrelated to a click-outside HOC package. The lack of an install hook does not mitigate execution when consumers impor...

The import-time downloader/executor is concrete malicious behavior, not normal telemetry. Absence of npm lifecycle hooks does not mitigate runtime execution on import.

This is concrete, silent remote code execution on package import, unrelated to the stated data-transformation purpose. The absence of an install hook does not mitigate the import-time exe...

The package contains an import-time remote binary downloader and launcher disguised as telemetry. The lack of install hooks does not mitigate runtime arbitrary code execution on import.

The package has no install hook, but its normal import path automatically downloads and executes remote, unverified binaries. The claimed telemetry/profiler functionality does not justify...

This is concrete, automatic remote payload execution on ordinary package import, not legitimate telemetry behavior.

The concrete import-time remote-payload download and detached execution chain establishes malicious behavior. Lack of an npm lifecycle hook does not reduce the runtime RCE impact.