npm remote execution reports, with evidence.

This is a concrete preinstall remote-code-execution chain, not behavior needed by the declared UI component package. The benign UI entrypoint does not account for the hidden bootstrap pay...

The install hook is unrelated to a browser RUM SDK and creates a concrete remote-code-execution chain. The benign dist entrypoint does not mitigate the preinstall payload.

The benign public entrypoint is decoupled from a malicious preinstall path. Obfuscation, runtime bootstrapping, token handling, and remote eval are concrete install-time attack behavior.

Source inspection confirms a concrete, unconsented preinstall bootstrapper executing an obfuscated payload that evaluates remotely supplied code. This is malicious behavior, not a package...

The preinstall chain executes an opaque, unrelated payload and dynamically evaluates network-delivered code. This is concrete malicious install-time behavior, not a package-aligned build...

The install hook is unrelated to the advertised UI library and deliberately bootstraps an obfuscated credential-capable payload. Benign source entrypoints do not mitigate install-time com...

The explicit preinstall chain executes an obfuscated payload that evaluates remotely fetched content. This is concrete malicious install-time behavior, not package-aligned component funct...

This package’s declared ESLint role does not justify an obfuscated install-time runtime bootstrap or payload execution. Source establishes a concrete malicious execution chain.

The install-time execution chain is concrete and unnecessary for an ESLint configuration package. Obfuscation and dynamic evaluation prevent trustworthy attribution of the payload's effects.

The lifecycle hook’s remote executable bootstrap is unrelated to a Jest preset, and the launched obfuscated payload contains concrete fetched-code eval and token-handling behavior. This i...

The preinstall payload is unrelated to the declared transformer and provides concrete remote payload execution plus credential-oriented behavior. This is malicious install-time behavior.

The package’s declared ESLint configuration is small, but its mandatory preinstall executes an unrelated obfuscated payload with dynamic eval and credential-focused behavior. This is conc...

The install hook executes a concealed, unrelated payload with remote dynamic evaluation and credential-handling primitives. This is concrete malicious install-time behavior, not package-a...

The package's advertised example source does not justify an obfuscated install-time runtime downloader or the bundled credential-aware, remotely evaluated payload. This is concrete malici...

The benign exported module does not justify a preinstall downloader that executes an obfuscated payload with remote eval and GitHub-token handling. These behaviors establish a concrete ma...

This is a concrete import-time remote code execution chain with stealthy payload delivery and execution. It is not required for the documented library API.

The package contains a concrete remote-code-execution chain, not merely service-worker registration logic. The fetched script is executed in Node via eval with no origin or integrity vali...

This is concrete import-time remote payload execution, not package-aligned telemetry. The absence of lifecycle hooks does not mitigate execution during normal use.

The package contains a reachable import-time downloader/executor, not just telemetry primitives. The absence of install hooks does not mitigate execution on normal use.

Source inspection confirms an import-triggered remote binary download and execution chain in _bridge.js. No lifecycle hook is needed because index.js invokes it at runtime.

This is a concrete import-time remote code execution chain, not ordinary telemetry: remote binary bytes are executed without authentication. The absence of an npm lifecycle hook does not...