npm remote execution reports, with evidence.

This is a concrete import-time remote payload delivery and execution chain unrelated to the package's stated markdown adapter API. The lack of lifecycle hooks does not mitigate execution...

Source establishes an import-time, unauthenticated remote-code-execution chain; it is not legitimate telemetry. The lack of an install hook does not mitigate execution during normal packa...

The hidden import-time loader provides a concrete remote binary execution chain, independent of npm lifecycle hooks. The benign-looking exported class does not justify that behavior.

This is a concrete import-time remote code execution chain, not ordinary telemetry. The package’s trivial public API does not justify hidden binary staging and detached execution.

The package has no legitimate implementation beyond a small stub, while its import-time vendor code performs unauthenticated remote payload execution. This is a concrete malware execution...

This is a concrete import-time staged payload chain with remote code execution, not ordinary telemetry. The unused telemetry file also contains materially similar downloader/launcher prim...

This is a concrete, automatic remote-payload execution chain triggered by import. The lack of an npm lifecycle hook does not mitigate the import-time execution.

Concrete import-time remote payload execution is present in _ext.js and is reachable from the declared main entrypoint. This is malicious behavior, not package-aligned telemetry.

The public entrypoint activates a concealed downloader/executor at import time. Its network fallback, hidden temp payload, and detached execution are not package-aligned scroll functional...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry: arbitrary downloaded bytes are executed silently and detached. The unused-or-unreferenced telemetry mod...

This is a concrete import-time remote-code-execution chain unrelated to the advertised UI component. The absence of lifecycle hooks does not mitigate execution when consumers import the p...

This is an import-time staged payload loader with direct execution, not legitimate telemetry. Absence of lifecycle hooks does not mitigate runtime compromise of consumers that require the...

Direct source inspection confirms an import-time staged payload chain with remote native execution. This is concrete malicious behavior, not telemetry required by the stated package funct...

This is a concrete import-time remote-code execution chain unrelated to the package's advertised abstraction API. The bundled telemetry source duplicates the same downloader/executor patt...

This is concrete, unconsented import-time remote payload execution, unrelated to the advertised UI toolkit. Lack of an npm lifecycle hook does not mitigate execution on ordinary package i...

Direct source inspection confirms an import-time staged payload downloader/executor. The absence of an npm lifecycle hook does not mitigate execution on normal package use.

This is concrete import-time remote code execution, not ordinary telemetry. The lack of an npm lifecycle hook does not mitigate execution when consumers import the declared main entrypoint.

Source inspection confirms an import-time remote payload downloader and executor. No lifecycle hook is needed because the malicious bridge runs whenever the package is imported.

This is a concrete import-time remote payload execution chain with no legitimate relationship to a carousel package. The unused telemetry module contains a substantially similar download-...

The package has no install hook, but ordinary runtime import triggers silent retrieval and execution of an unverified native payload. The documented UI surface does not justify this behav...

The import-time execution chain is directly present in source and downloads then launches untrusted remote content. No lifecycle hook is required for the package to execute the payload wh...