npm remote execution reports, with evidence.

This is a concrete import-time staged payload chain with arbitrary binary execution, unrelated to the advertised pub/sub adapter. The absence of npm lifecycle hooks does not mitigate the...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The absence of npm lifecycle hooks does not mitigate activation through the package main entrypoint.

The package contains an import-time, obfuscated remote payload loader that executes unverified downloaded binaries. Lack of lifecycle hooks does not mitigate the reachable runtime attack...

This is concrete import-time remote payload execution, unrelated to the advertised metrics collector. The absence of an install hook does not mitigate execution when consumers import the...

This is a concrete, automatic remote-payload execution chain unrelated to the declared carousel functionality. It is malicious despite having no npm lifecycle script.

The reachable import-time loader provides a concrete arbitrary remote code execution chain, not legitimate telemetry behavior. Lack of an npm lifecycle hook does not mitigate execution on...

The package's only advertised runtime API does not require telemetry, yet its entrypoint silently fetches and executes unverified remote bytes. This is a concrete import-time remote-code-...

This is concrete import-time staged payload execution, not package-aligned telemetry. The absence of lifecycle hooks does not mitigate execution whenever consumers import the package.

The package's import-time loader provides an unauthenticated remote-code-execution chain with concealed endpoints and no legitimate API linkage. This is concrete malicious behavior, indep...

This is a concrete, automatic remote-payload execution chain unrelated to the advertised minimal forms package. Lack of install hooks does not mitigate import-time execution.

Source directly establishes import-time remote payload retrieval and execution. The package description and exposed API do not justify this behavior.

The package contains a concrete, automatically reachable remote binary download-and-execute chain unrelated to its advertised carousel interface. This is malicious remote code execution,...

This is a concrete import-time staged payload execution chain, unrelated to the advertised visual-components/circuitbreaker API. Absence of an npm lifecycle script does not mitigate runti...

The documented pub/sub package has an undeclared import-time remote payload execution chain unrelated to its stated functionality. This is concrete malicious behavior, not telemetry.

The source implements concrete download-and-execute behavior on normal package import, with obfuscated endpoints and no integrity validation. The lack of npm lifecycle hooks does not miti...

The malicious chain is concrete, import-reachable, and executes unauthenticated remote bytes; the telemetry naming does not provide a legitimate package-aligned purpose.

The package’s import path contains a concrete, stealthy remote code-execution chain unrelated to its stated GitLab-label SDK purpose. This is malicious behavior, not benign telemetry.

The package implements an unverified staged payload path culminating in dynamic code execution, not merely data-driven audit rules. Lack of an install hook limits activation to explicit C...

Source confirms an import-triggered remote payload loader and detached execution chain. The absence of an npm lifecycle hook does not mitigate runtime compromise of package consumers.

This is a concrete import-time remote-code-execution chain unrelated to the advertised state-store functionality. The opt-out variables and telemetry README claim do not justify downloadi...

This is a concrete import-time staged-payload execution chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate execution when consumers import the package.