npm remote execution reports, with evidence.

This is concrete import-time remote code execution unrelated to the package's documented minimal API. Absence of lifecycle scripts does not mitigate execution on normal import.

This is a concrete import-time staged-payload execution chain unrelated to the package's advertised interface. The lack of install hooks does not mitigate execution when consumers import...

This is an import-time, unconsented remote binary loader and executor, not package-aligned documentation functionality. The lack of lifecycle scripts does not mitigate the reachable runti...

This is a concrete, import-triggered remote payload execution chain with stealth-oriented temporary paths and detached execution. The absent npm lifecycle hook does not mitigate execution...

The concealed payload executes automatically on import and contains both network logic and dynamic detached child-process execution. This is concrete malicious behavior, not a package-ali...

The hidden import-time loader, blockchain-based C2 discovery, and remote second-stage execution are concrete malicious behavior unrelated to the package function. No lifecycle hook is req...

Although activation is user-invoked rather than install-time, the package conceals a remote shell behind a health-client interface. The concrete command-and-control behavior warrants bloc...

The package contains a concrete remote-code-execution chain, not merely a service-worker registration helper. Absence of install hooks does not mitigate execution when the plugin is used.

Direct source inspection confirms an externally controlled payload is dynamically executed. The lack of install hooks does not mitigate runtime remote code execution.

This is concrete remote code execution and command-output exfiltration functionality, concealed by a large decoded eval payload. The lack of lifecycle hooks limits automatic activation bu...

This is a concrete install-time remote-code-execution chain unrelated to the package’s small local exports and claimed RTDS functionality.

This is concrete, undisclosed import-time remote payload execution, not telemetry aligned with a small utility package. The absence of lifecycle scripts does not mitigate the reachable ma...

The import-time remote binary loader and detached execution are concrete malicious behavior, not ordinary telemetry. No lifecycle hook is needed because the package entrypoint triggers th...

This is concrete import-time remote code execution with obfuscated endpoints and no user-directed feature activation. The absence of npm lifecycle scripts does not mitigate runtime compro...

Source inspection confirms a concrete import-time remote payload execution chain. The absence of lifecycle hooks does not mitigate malicious runtime behavior.

The import-time bridge provides a concrete, stealthy remote code-execution chain unrelated to the advertised SDK. The absence of lifecycle hooks does not mitigate execution during normal...

This is an import-time remote-code-execution loader unrelated to the documented SDK API. The opaque payload source, DNS fallback, concealed host construction, and detached execution estab...

The declared entrypoint performs concrete, automatic remote payload execution at import time. No install hook is needed for this to be a malicious RCE chain.

This is concrete import-time remote code execution, not aligned with the advertised highlighted-text module. Lack of lifecycle scripts does not mitigate execution on normal use.

This is a concrete import-time remote payload execution chain unrelated to the advertised SDK. The absence of install hooks does not mitigate execution when an application imports the pac...

The package contains concrete, import-time remote binary execution concealed behind an unrelated fonts API. This is a direct malware execution chain, not normal telemetry.