Malicious packages, on record.

The source implements an obfuscated remote-code loader with automatic browser activation. Absence of lifecycle hooks limits install-time impact but does not remove the concrete runtime RC...

This is concrete malicious runtime behavior unrelated to mutex functionality, including host reporting and remote code execution. Absence of lifecycle hooks does not mitigate the callable...

This is a concrete install-triggered C2 and remote-control chain, not merely a bundled desktop application. The lifecycle hook runs it without an explicit user command.

The runtime entrypoint contains an explicit remote download-and-execute chain, corroborated by a bundled file that invokes it. Absence of an install hook does not mitigate this concrete r...

The source contains a concrete, reachable remote download-and-execute chain. Absence of an install hook limits automatic activation but does not remove the malicious runtime payload.

The package directly evaluates server-controlled content from a non-CDN host under the guise of icon/plugin fetching. Absence of install-time execution limits the trigger but does not rem...

Source inspection confirms a reachable remote-download-to-shell execution chain with no legitimate package functionality evident. Absence of lifecycle hooks limits automatic activation bu...

The advertised library code is benign, but its postinstall hook silently stages and executes server-controlled code. This is a concrete malicious supply-chain execution chain.

The main entrypoint performs unconditional remote payload retrieval and dynamic execution. This is a concrete remote-code-execution chain, not a benign network use.

Source inspection confirms an import-time detached payload launcher and an obfuscated remote dynamic-code loader. The absence of lifecycle hooks does not mitigate runtime compromise on im...

The install-time reverse shell is concrete, automatic remote command execution unrelated to date formatting. The package is malicious even though its auxiliary collection file is not invo...

The manifest directly defines an unconsented install-time reverse shell to a fixed external IP. The unused bundled reconnaissance/exfiltration script corroborates the malicious purpose.

Confirmed source contains a staged remote-code-execution loader, despite no npm install hook. The deferred trigger does not reduce the concrete malicious behavior.

Source inspection confirms concrete staged remote execution and detached process launch, not merely suspicious primitives. Absence of lifecycle hooks does not mitigate import-time execution.

Source establishes an automatic remote-payload-to-execution chain with no user invocation or integrity verification. This is concrete malware behavior, not ordinary telemetry.

This is concrete import-time staged payload execution, not normal telemetry: opaque remote binaries are fetched, dropped, and executed without user action. The same behavior is also imple...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. No lifecycle hook is needed because index.js reaches the loader whenever consumers import the package.

This is a concrete, import-triggered remote code execution chain with concealed payload delivery and detached execution. The absence of npm lifecycle scripts does not mitigate the runtime...

The import-time bridge is a concrete staged malware loader, independent of npm lifecycle scripts. The telemetry module also implements a similar configurable native-extension loader.

The import-time remote download-and-execute chain is concrete source behavior, not a scanner-only inference. It is unrelated to the package's stated TypeScript-definition purpose.

Source directly confirms an automatic staged payload downloader and executor at the package entrypoint. The lack of install hooks does not mitigate runtime import-time execution.