npm remote execution reports, with evidence.

The package's public entrypoint automatically performs an unauthenticated remote payload retrieval and execution chain. No user action beyond importing the package is required.

This is concrete import-time remote code execution, not ordinary telemetry: fetched opaque bytes are executed without validation. The similar profiler loader in lib/telemetry.js reinforce...

The package contains a concrete, reachable import-time remote payload execution chain unrelated to its advertised minimal interface. This is malicious behavior, not benign telemetry.

This is concrete, automatically triggered remote native payload execution unrelated to the declared visual-components package. The telemetry-themed library duplicates the same downloader/...

The public entrypoint unconditionally triggers an obfuscated downloader-executor at runtime. No legitimate SDK functionality explains remote binary retrieval and detached execution.

This is a concrete import-time staged-payload execution chain unrelated to the documented core-runtime API. Absence of an install hook does not mitigate execution when consumers import th...

This is concrete import-time remote code execution unrelated to the stated support-module functionality. Lack of an npm lifecycle hook does not mitigate execution when consumers import th...

This is concrete import-time staged-payload execution, not package-aligned telemetry. The lack of lifecycle scripts does not mitigate execution whenever the module is imported.

This is a concrete import-time staged-payload execution chain, not telemetry: it retrieves and runs an unverified native binary without user action. The absence of lifecycle hooks does no...

The runtime-imported bootstrap implements an unconsented remote payload execution chain; no lifecycle hook is needed for activation. The benign-looking exported class does not mitigate th...

This is a concrete import-time staged payload and native execution chain, not normal telemetry. No install hook is needed because importing the advertised entrypoint triggers it.

This is an import-time remote binary loader and launcher with no package-aligned purpose or user consent. The concrete download-to-disk-to-detached-execution chain warrants blocking.

Source establishes an immediate, stealthy download-and-execute chain on import. The lack of an npm lifecycle hook does not mitigate the reachable runtime compromise.

This is concrete import-time remote payload execution, not legitimate telemetry: the declared API client has no need to fetch and launch hidden executables. The lack of install hooks does...

This is a concrete import-time staged-payload execution chain, not telemetry behavior. The lack of lifecycle hooks does not mitigate runtime remote code execution on import.

This is a concrete, automatically reachable remote-payload execution chain with stealthy delivery and execution. The absence of npm lifecycle hooks does not mitigate import-time RCE.

The import-time loader has no package-aligned function and directly stages and executes attacker-controlled remote bytes. The benign-looking API and telemetry module do not mitigate that...

Source inspection confirms an import-time staged-payload downloader and executor, not merely telemetry. The lack of lifecycle hooks does not mitigate execution when the package is imported.

This is a concrete import-time remote payload execution chain unrelated to the advertised icons package. No lifecycle script is needed because the malicious loader runs from the main entr...

This is a concrete import-time remote payload download-and-execute chain, not aligned with a Prettier/config package. The unused telemetry file contains similar staged native-execution ma...

The source implements concrete, undisclosed remote binary retrieval and execution on import. The absence of lifecycle hooks does not mitigate this reachable runtime execution chain.