npm remote execution reports, with evidence.

This is a concrete, stealthy import-time remote payload execution chain unrelated to the stated token utility. The lack of install hooks does not mitigate runtime compromise when consumer...

Source inspection confirms concrete import-time download-and-execute behavior. The absence of lifecycle hooks does not mitigate execution when consumers import the main entrypoint.

This is a concrete import-time remote-payload execution chain unrelated to the documented holder interface. No install hook is required for compromise.

This is concrete, unconsented import-time remote code execution unrelated to the advertised logging middleware. The DNS fallback and obfuscated endpoints further establish a staged malwar...

The entrypoint reaches an automatic remote native-payload execution chain; it is unrelated to the documented minimal device-integration API. Lack of an npm lifecycle hook does not mitigat...

Source establishes an import-time staged payload download and detached native execution chain; no user action beyond importing the SDK is required. The telemetry-like naming and opt-out c...

This is concrete import-time staged-payload execution unrelated to the advertised cashback API. Lack of an npm lifecycle hook does not mitigate the reachable runtime execution path.

This is a concrete import-time staged payload loader with remote native-code execution, unrelated to the advertised logging middleware. The absence of npm lifecycle hooks does not mitigat...

This is a concrete, import-time remote payload execution chain unrelated to the advertised token interface. The absence of install hooks does not mitigate runtime compromise on ordinary i...

The package's advertised API is inert, but its import-time side module implements an unconsented download-and-execute chain. This is concrete malware behavior, not telemetry.

Direct inspection confirms an import-time downloader/executor unrelated to the declared test-component API. The absence of lifecycle hooks does not mitigate runtime arbitrary-code execution.

The package executes an obfuscated, unverified remote binary loader on import. The absence of lifecycle hooks does not mitigate this reachable runtime RCE.

The manifest has no install hook, but normal runtime import immediately reaches a concealed remote binary loader and detached executor. This is concrete malware behavior, not package-alig...

This is concrete import-time remote payload execution unrelated to the documented types abstraction. The absence of lifecycle hooks does not mitigate execution when consumers import the p...

The package has no install hook, but ordinary import reaches an undeclared remote payload downloader and detached executor. This is concrete malicious runtime behavior, not telemetry.

This is a concrete, import-triggered remote binary execution chain unrelated to the documented claims wrapper. The dormant telemetry module mirrors the same loader design but is not requi...

This is a concrete import-time remote payload execution chain unrelated to the stated claims-visibility API. The absence of lifecycle hooks does not mitigate execution on ordinary package...

The package's normal import path contains an immediately invoked downloader/executor with concealed endpoints and no integrity verification. Absence of npm lifecycle hooks does not mitiga...

This is concrete import-time remote payload execution, not legitimate package functionality. The unused telemetry file is additional suspicious material but is unnecessary to establish th...

This is concrete import-time remote payload execution unrelated to the declared claims API. No install hook is needed for the package to execute arbitrary remote code when consumed.

The malicious execution chain is directly reachable from the main entrypoint and requires no user opt-in. No integrity verification is performed despite the source comment claiming one.