npm remote execution reports, with evidence.

Source directly establishes an automatic remote-payload download-and-execute chain. No install hook is needed because normal runtime import activates it.

Concrete source shows unconsented import-time download-and-execute behavior with obfuscated endpoints and no legitimate uploader implementation. Absence of lifecycle scripts does not miti...

This is a concrete, automatic remote-code-execution chain on package import, unrelated to the advertised lightweight SDK interface.

This is a concrete import-time staged payload execution chain, unrelated to the stated select-fields functionality. The lack of an npm lifecycle hook does not mitigate execution on normal...

This is concrete import-time remote payload execution, not a package-aligned utility feature. The absent install hook does not mitigate execution on ordinary use.

The concealed import-time download-and-execute chain is concrete remote code execution and unrelated to the tiny advertised library API. Absence of an npm lifecycle hook does not mitigate...

This is a concrete import-time staged payload and arbitrary native-code execution chain, unrelated to the package's exposed trivial API. The lack of an install hook does not mitigate runt...

Source inspection confirms an import-time remote-code execution chain with no user action or payload integrity verification. The unused-looking telemetry module contains the same download...

This is concrete import-time remote code execution, not telemetry: an opaque remote binary is downloaded, dropped, and launched detached. The lack of lifecycle hooks does not mitigate the...

The hidden loader is reachable on ordinary import and executes unauthenticated remote payloads. Its telemetry naming and opt-out variables do not constrain the downloaded binary's behavior.

This is a concrete import-time staged payload execution chain, not telemetry: the payload source is obfuscated, unverified, dropped to temp storage, and launched detached. The unused tele...

The source establishes an import-time, obfuscated remote payload chain with direct eval and detached process execution. Absence of npm lifecycle hooks does not mitigate execution when the...

The install-time detached loader fetches and executes attacker-controlled remote code, which is concrete malicious behavior unrelated to an ESLint plugin.

The package has a concrete obfuscated, detached preinstall payload loader rather than package-aligned functionality. Its remote code execution path is directly established from source.

The advertised plugin is benign, but the preinstall bootstrap and obfuscated second stage establish concrete malicious install-time behavior.

The benign ESLint rule is accompanied by an unrelated, obfuscated preinstall payload that downloads a runtime, executes it, and evaluates fetched code. This is concrete malicious install-...

Concrete preinstall execution, downloader behavior, obfuscation, and runtime eval establish malicious install-time remote code execution.

The install-time loader is unrelated to the declared chart package and creates a concrete remote-code-execution chain with credential-access capability.

This is concrete, unconsented install-time remote payload execution, not normal component-kit behavior. The benign UI source does not mitigate the lifecycle attack path.

The lifecycle payload is materially unrelated to the advertised package and establishes remote code execution at install time. Obfuscation and credential-token logic reinforce malicious i...

The package contains a concrete, unconsented preinstall remote-code-execution chain. The benign CLI does not justify the obfuscated secondary payload.