npm remote execution reports, with evidence.

The package’s only public entrypoint executes a concealed remote payload chain with no user action beyond importing it. No legitimate wrapper functionality explains binary retrieval and d...

This is concrete import-time remote code execution, not legitimate telemetry: the downloaded bytes are executed without validation and are concealed behind a benign wrapper.

This is a concrete import-time remote payload execution chain with obfuscated endpoints and no integrity verification. The lack of lifecycle hooks does not mitigate execution when the adv...

The package performs concrete import-time staged payload delivery and detached execution, which is remote code execution rather than legitimate loader functionality.

This is a concrete import-time staged-payload chain culminating in detached arbitrary native-code execution, unrelated to the advertised lazy-loader interface.

This is concrete import-time remote code execution, not package-aligned telemetry. The unused telemetry file contains a similar downloader pattern but does not mitigate the active _shim.j...

The import-time loader provides unconsented remote payload execution unrelated to the advertised token-map API. Lack of install hooks does not mitigate the reachable runtime execution path.

This is a concrete, silent import-time remote payload execution chain unrelated to the declared select-user library. Absence of npm lifecycle hooks does not mitigate the reachable runtime...

Source confirms an import-time remote payload download-and-execute chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate runtime RCE on package import.

This is a concrete, concealed import-time remote payload execution chain unrelated to the documented bus API. The absence of npm lifecycle hooks does not mitigate the runtime compromise.

This is a concrete import-time remote-code-execution chain unrelated to the documented readiness API. No lifecycle hook is needed because the malicious behavior activates whenever an appl...

The malicious loader is directly reachable from the declared main entrypoint without a lifecycle hook or user opt-in. Its download-and-execute chain is concrete and unrelated to the adver...

Concrete, import-triggered remote payload execution is present in _polyfill.js and is reachable from index.js. The lack of an npm lifecycle hook does not mitigate this runtime execution p...

The import-triggered, unauthenticated download-and-execute chain is concrete remote code execution behavior and unrelated to the advertised type wrapper.

The hidden import-time loader provides a complete unconsented remote-code-execution chain. Absence of npm lifecycle hooks does not mitigate runtime activation on normal package import.

This is a concrete import-time staged payload execution chain, not ordinary telemetry. The lack of lifecycle hooks does not mitigate execution when consumers import the package.

This is a concrete import-time remote-code-execution chain disguised as compatibility/telemetry behavior. Absence of an npm lifecycle script does not mitigate execution when consumers imp...

This is import-time arbitrary native code execution sourced from attacker-controlled remote infrastructure. Absence of an npm lifecycle hook does not mitigate the reachable main-entrypoin...

This is a concrete import-time remote payload execution chain, not telemetry. The absence of lifecycle hooks does not mitigate execution on normal package use.

This is concrete runtime remote-code execution, not ordinary telemetry: a minimal adapter imports a hidden loader that retrieves and launches unsigned binaries. The absence of lifecycle h...

This is a concrete import-time staged-payload execution chain, not merely telemetry. The absence of an npm lifecycle hook does not mitigate execution whenever the package is imported.