npm remote execution reports, with evidence.

This is a concrete import-time remote payload execution chain unrelated to the advertised REST client wrapper. The package provides no signature, hash, or user-invoked setup boundary for...

Source inspection confirms an import-time staged payload downloader and detached executor, with no legitimate integration path exposed by the advertised wrapper. Absence of an npm lifecyc...

The package's documented claims-conversion API does not require a covert native downloader or detached payload execution. The executable payload is remote-controlled and runs automaticall...

Source directly establishes import-time remote payload retrieval and execution, unrelated to the advertised wrapper API. The absence of an install hook does not mitigate runtime compromis...

This is a concrete import-time remote code execution chain, not merely telemetry behavior. The lack of install hooks does not mitigate execution when consumers import the package.

The package’s stated component API does not require a hidden import-time executable downloader. The direct source establishes a concrete remote payload execution path.

This is a concrete import-time staged payload downloader and executor unrelated to the declared filter API. Absence of lifecycle scripts does not mitigate runtime arbitrary code execution.

The import-time code establishes a complete download-to-execution chain with obfuscated endpoints and no user invocation or integrity verification. Absence of npm lifecycle hooks does not...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry: the downloaded content is directly executed detached. The larger telemetry module contains a matching h...

The import-reachable downloader and detached binary launcher are concrete malicious behavior, not telemetry. Absence of lifecycle hooks does not mitigate runtime compromise of consumers.

This is concrete import-time staged payload execution, not legitimate telemetry: the package advertises only foundational types and exposes no related user-invoked feature.

The package’s import-time helper implements a concealed remote binary loader unrelated to its advertised React component API. The concrete download-to-disk-to-detached-execution chain is...

This is an import-time staged remote payload execution chain unrelated to the declared mailing-constructor API. Absence of lifecycle hooks does not mitigate execution when consumers impor...

This is an import-time staged remote-code-execution chain, not ordinary telemetry: it silently retrieves and launches opaque binaries. The absence of install hooks does not mitigate execu...

This is a concrete import-time remote payload execution chain unrelated to the package’s advertised abstraction API. The absence of lifecycle hooks does not mitigate runtime RCE on ordina...

This is a concrete import-time remote payload execution chain, disguised as telemetry and unrelated to the documented API. Absence of npm lifecycle hooks does not mitigate execution when...

This is concrete import-time staged-payload execution, unrelated to the package’s stated validation function. The lack of a lifecycle hook does not mitigate execution when a consumer impo...

The import-time downloader/executor is concrete malicious behavior, not package-aligned telemetry. No install hook is needed because normal package use triggers execution.

This is concrete import-time remote payload execution, not package-aligned telemetry. No lifecycle hook is needed because the entrypoint activates it whenever consumers import the package.

The reachable import-time loader implements a concrete remote payload download-and-execute chain. Its telemetry labels do not change the executable behavior.

This is an import-triggered remote payload execution chain with no integrity validation or user-invoked action. The absence of lifecycle hooks does not mitigate execution on normal packag...