npm remote execution reports, with evidence.

This is a concealed remote code execution chain unrelated to a Tailwind forms plugin. The absence of install hooks does not mitigate execution on normal package import.

The package contains an import-time detached remote-code execution chain unrelated to its advertised utility purpose. This is concrete malicious behavior even without an npm lifecycle hook.

This is concrete credential exfiltration and remotely controlled code execution on import. The Base64 endpoint encoding further conceals the behavior.

This is a concrete remote-code-execution loader activated by a normal import, with persistence-like detached process behavior. The lack of an install hook does not reduce the import-time...

This is a concealed import-time remote code execution chain with self-modification, unrelated to a Tailwind forms plugin. The absence of an install hook does not mitigate execution throug...

This is a concrete import-time remote-code-execution backdoor with detached-process persistence. The absence of an install hook does not reduce the risk to consumers that import the decla...

This package contains an import-triggered detached remote-code loader, not the runtime utilities claimed by its manifest. The remote payload is executed with Node module access, creating...

This is a concrete install-time remote-code-execution backdoor, not functionality required by the stated n8n health-monitor node. The listener is exposed on all interfaces and has no auth...

The package executes an opaque remotely supplied payload automatically on import through a detached background process. Although it has no install hook, this is concrete remote code execu...

This is a concrete remote code execution path concealed behind an exported middleware and detached subprocess. The absence of an install hook does not mitigate runtime execution of server...

The declared runtime entrypoint directly invokes an obfuscated remote-binary downloader and process launcher. The absence of a lifecycle script limits the install-time trigger but does no...

The package implements an import-triggered detached remote-code loader rather than a bounded client feature. Its remote payload receives Node module-loading capability, establishing concr...

This is concrete remote code execution activated by a normal import, with detached-process persistence. The absence of an install lifecycle hook does not mitigate the import-time payload...

The package establishes an import-triggered detached process that fetches and executes remotely supplied code. This is concrete remote code execution and persistence-like behavior, not a...

The complete remote-code execution path is present in the published source and activates on ordinary import. Detached execution and PID tracking add persistence behavior.

The package implements an import-triggered detached remote-code loader, not a bounded package feature. The absence of an npm lifecycle hook does not mitigate runtime arbitrary code execut...

This is a concrete remote code execution backdoor activated through the package's normal export. Concealment, detached execution, and remote dynamic evaluation leave no package-aligned be...

This is an import-triggered remote code execution chain with persistence-like detached execution, not a package-aligned client feature.

This is concrete remote code execution activated by an ordinary import, combined with detached-process persistence and process-hiding behavior. The lack of an npm lifecycle hook does not...

The sole install-time script is an explicit reverse-shell command with external output forwarding. This is concrete malicious behavior activated without user interaction beyond installation.

The import-time loader combines remote payload execution, detached process creation, and self-removal. These behaviors are concrete malicious execution, even though npm lifecycle hooks ar...