npm remote execution reports, with evidence.

Source establishes a concrete, automatic download-and-execute chain on package import, unrelated to the advertised wrapper API. No lifecycle hook is needed for the impact.

Source inspection confirms a concrete import-time downloader-and-executor chain, independent of lifecycle scripts. The benign-looking exported bridge does not prevent the side-effecting _...

Concrete import-time download-and-execute behavior is present in _adapter.js, independent of scanner labels. The lack of an npm lifecycle hook does not mitigate execution when consumers i...

Source inspection confirms a concrete hidden payload download-and-execute chain reachable through the normal import path. The lack of lifecycle hooks does not mitigate the import-time exe...

Source inspection confirms an import-triggered downloader and detached execution path; no lifecycle hook is needed for the malicious behavior. The telemetry file duplicates the same binar...

The package’s import path performs an unconsented download-and-execute chain with obfuscated infrastructure and no validation. The absence of npm lifecycle hooks does not mitigate executi...

The import-time remote payload execution chain is explicit in source and requires no user setup action. The unused-looking telemetry module does not mitigate this behavior.

This is concrete import-time remote payload execution, unrelated to the declared native-bridge API. Lack of an npm lifecycle hook does not mitigate execution on ordinary package import.

Source inspection confirms an import-time remote payload download-and-execute chain unrelated to the declared mobile SDK function. The lack of npm lifecycle hooks does not mitigate the re...

This is concrete, import-triggered remote code execution rather than declared telemetry functionality. The lack of an install hook does not mitigate execution during ordinary use.

This is concrete import-time remote binary retrieval and execution, unrelated to the stated token-provider function. No lifecycle hook is needed because the entrypoint triggers the payloa...

Direct source inspection confirms a reachable import-time downloader and executor, not merely telemetry behavior. The lack of install hooks does not mitigate runtime execution on package...

This is an unconsented import-time staged payload chain culminating in arbitrary native code execution. The harmless-looking public API and unused telemetry source do not mitigate that co...

The import-time loader establishes a concrete staged-payload execution chain; the lack of an npm lifecycle hook does not mitigate runtime compromise.

This is a concrete import-triggered remote payload execution chain unrelated to the advertised UI package. Lack of lifecycle hooks does not mitigate the malicious runtime side effect.

The package contains concrete, stealthy import-time remote payload execution unrelated to its stated mobile payment-widget purpose. This is malicious despite the absence of lifecycle hooks.

The package entrypoint contains an import-time, obfuscated downloader/executor with no legitimate API relationship to the declared foundational-types package. This establishes concrete ma...

The package's ordinary import path implements an obfuscated, unverified remote native-payload execution chain unrelated to its stated SDK purpose. This is concrete malware behavior, not m...

Source directly establishes an import-time downloader/dropper/executor chain. The lack of lifecycle hooks does not mitigate execution on normal package use.

This is a concrete import-time remote payload execution chain unrelated to the documented foundational-types API. The lack of an npm lifecycle hook does not mitigate runtime execution on...

This is concrete import-time remote code execution, disguised as telemetry compatibility behavior. The lack of an install hook does not mitigate execution when any consumer imports the pa...