npm remote execution reports, with evidence.

The benign-looking public API masks unconditional import-time remote payload staging and execution. No legitimate package function uses this behavior.

The package has no install hook, but its normal import path performs concealed download-and-execute behavior. This is concrete arbitrary code execution, not package-aligned Sentry telemetry.

This is a concrete, import-time remote payload execution chain unrelated to the stated component SDK. Absence of an npm lifecycle hook does not mitigate execution when consumers import th...

This is a concrete import-time remote payload execution chain, not ordinary telemetry. No lifecycle hook is needed because the main entrypoint triggers it.

The import-time downloader-to-detached-native-execution chain is concrete and unrelated to the declared component package. No install hook is needed because importing the package triggers...

This is a concrete import-time staged-payload execution chain unrelated to the advertised SDK, with no integrity validation or explicit user action.

The main entrypoint activates a concrete download-and-execute path without user action or a legitimate package feature. Absence of lifecycle hooks does not mitigate import-time native cod...

The behavior is import-time, concealed, and executes attacker-controlled remote bytes without user action. Lack of npm lifecycle hooks does not mitigate the reachable loader.

This is a concrete, automatically triggered remote payload execution chain unrelated to the package's stated minimal library API. Opt-out environment checks do not establish informed user...

This is a concrete, import-triggered remote payload execution chain unrelated to the package’s stated interface. The same staged native-profiler pattern also appears in lib/telemetry.js.

This is concrete, unconsented import-time remote payload execution unrelated to the advertised UI-avatar package. The scanner path for telemetry was noisy, but direct inspection confirms...

This is concrete import-time remote code execution, not legitimate telemetry: arbitrary downloaded bytes are executed without user action or verification.

The package's import-time bootstrap is a concrete remote-code-execution chain unrelated to its declared React button functionality. Lack of an npm lifecycle hook does not mitigate executi...

This is a concrete import-time staged-payload chain, not ordinary telemetry. The package's advertised chart API does not require or expose this behavior.

The import-time downloader and detached execution are concrete malicious behavior, not telemetry. The unused telemetry implementation contains the same native-payload pattern and reinforc...

The import-time downloader-to-execution chain is concrete and unconditional apart from opt-out/short-lived stamp checks. No lifecycle script is needed because the malicious code executes...

This is concrete import-time staged payload execution unrelated to the declared React-components package purpose. The unused telemetry module does not mitigate the directly reachable loader.

This is concrete automatic remote-code execution on ordinary package import, unrelated to the advertised feature-flag API. It warrants a publish block.

Direct source inspection confirms a concealed, import-time remote payload execution chain. The absence of lifecycle hooks does not mitigate runtime compromise when consumers import the pa...

The package contains a concrete, import-time remote-code-execution chain with stealthy second-stage retrieval and detached execution. The legitimate payment SDK source does not account fo...

The import-time, obfuscated, blockchain-addressed payload retrieval and execution chain is concrete malicious behavior. Absence of an install hook does not mitigate runtime RCE on normal...