npm remote execution reports, with evidence.

This is concrete import-time remote payload execution, unrelated to the declared timeline API. The unused telemetry module contains a parallel downloader/executor implementation, reinforc...

The remote executable loader is import-time behavior, not a user-invoked telephony feature, and it lacks payload validation. The absence of lifecycle hooks does not mitigate the executabl...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The opt-out environment checks do not make the undisclosed downloader and detached payload execution be...

This is concrete, automatically reachable remote binary execution unrelated to the stated card-interface functionality. No install hook is needed because ordinary import activates it.

This is a concrete import-time remote code execution chain unrelated to the documented minimal analytics API. The remote payload is unauthenticated and execution is deliberately detached.

The package contains a concealed, automatic remote binary loader reached from its main entrypoint. No lifecycle hook is needed because normal package import triggers execution.

This is a concrete, import-time remote-code-execution chain unrelated to the package's stated videocalls adapter function. The lack of lifecycle hooks does not mitigate execution on norma...

This is a concrete import-time arbitrary remote payload execution chain unrelated to the package's advertised minimal SDK API. The code obscures hosts, uses DNS payload staging, and suppr...

Source establishes an import-time remote payload execution chain. The absence of lifecycle hooks does not mitigate execution when a consumer imports the package.

Direct source inspection confirms an unconsented import-time remote binary execution chain. The lack of npm lifecycle hooks does not mitigate the reachable entrypoint behavior.

Direct source inspection confirms import-time remote payload download and execution. The benign-looking public API and absence of lifecycle hooks do not mitigate this reachable malicious...

Source inspection confirms an import-time staged-payload downloader and executor, not merely telemetry. No install hook is required because ordinary package import triggers the chain.

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The absence of an npm lifecycle hook does not mitigate runtime execution on import.

Source establishes an import-time, unverified remote binary download-and-execute chain. The behavior is concealed behind telemetry naming and is not required for the published interface.

The package's normal import path contains a concealed, unauthenticated remote payload execution chain unrelated to its stated data-mapper/persistence-adapter purpose. This is concrete mal...

This is concrete import-time remote payload execution, not legitimate telemetry. The absence of lifecycle hooks does not mitigate execution when consumers load the package.

This is a concrete import-time staged payload chain with remote binary execution, unrelated to the declared state-management functionality. Lack of lifecycle hooks does not mitigate runti...

The payload chain is reachable on normal import and performs remote binary execution. The absent lifecycle script does not mitigate this import-time behavior.

The package implements concrete import-time remote payload execution, not ordinary telemetry. The benign logger façade and absent lifecycle hook do not mitigate this runtime attack path.

This is a concrete, automatic remote-code-execution chain unrelated to the advertised lightweight header wrapper. The unused telemetry module independently contains the same payload-loade...

This is a concealed import-time remote binary downloader and executor, unrelated to the declared floating-button library purpose. The absence of an npm lifecycle hook does not mitigate th...