npm remote execution reports, with evidence.

This is concrete import-time staged remote code execution unrelated to the exported metrics collector. The absence of lifecycle scripts does not mitigate execution on normal package import.

The malicious chain is reachable through the declared main entrypoint and needs no install hook or explicit package API call. The telemetry file reinforces the same staged-payload behavio...

The package implements an unconsented import-time remote binary loader and executor unrelated to its documented Operations SDK API. This is concrete malicious behavior, not merely telemetry.

Direct source inspection confirms an import-time staged payload downloader and executor unrelated to the declared minimal package API. Absence of lifecycle hooks does not mitigate the rea...

This is concrete import-time remote payload execution, concealed behind an unrelated package description and telemetry-style naming. No lifecycle hook is needed because ordinary package i...

This is a concrete import-time remote code execution chain unrelated to the stated forms interface, with obfuscated endpoints and no payload validation.

This is concrete import-time remote code execution, not package-aligned telemetry: opaque binaries are remotely staged and launched without validation. The absence of lifecycle hooks does...

This is concrete import-time staged payload execution with no legitimate relationship to the declared datetime library. Lack of lifecycle hooks does not reduce the direct require-time exe...

The package has a normal-looking PostCSS facade, but its import-time appended payload is an explicit remote loader and executor. The behavior is unrelated to the declared CSS transformati...

The behavior is reachable during ordinary package import and executes an unauthenticated remote binary without user action. The telemetry naming and opt-out variables do not mitigate the...

The payload chain is reachable from the declared main entrypoint and enables arbitrary remote code execution without user action. Absence of lifecycle scripts does not mitigate import-tim...

The declared entrypoint causes concrete remote-payload execution without a user-invoked setup action. The benign metrics export does not justify this hidden import-time binary launcher.

This is a concrete, import-triggered remote payload download-and-execute chain unrelated to the stated chat-message interface. Absence of npm lifecycle hooks does not mitigate runtime RCE.

This is a concrete, reachable remote payload execution chain, not ordinary telemetry. Lack of an npm lifecycle hook only limits the trigger to package import.

This is a concrete import-time staged-payload and remote-execution chain unrelated to the declared UI toolkit. The absence of lifecycle hooks does not mitigate execution through the norma...

This is a concrete import-time remote-code-execution chain unrelated to the declared config SDK functionality. The lack of npm lifecycle hooks does not mitigate runtime import execution.

The malicious loader is reachable at import time and executes unverified remote bytes. No lifecycle hook is required for the attack to affect package consumers.

This is a concrete import-time remote payload execution chain unrelated to the exported metrics collector. The absent npm lifecycle hook does not mitigate execution on normal package import.

The package has a concrete import-time download-and-execute chain with obfuscated endpoint construction and DNS fallback. This is remote code execution, not package-aligned telemetry.

This is a concrete import-time staged payload loader and remote code execution chain, not ordinary telemetry. The unused telemetry module contains a parallel configurable loader design, r...

This is an import-time staged payload loader with covert fallback transport and detached execution; it is unrelated to the documented abstraction-layer API.