npm remote execution reports, with evidence.

The package's public import path reaches a concealed downloader/executor without user action. The telemetry file also contains substantially the same payload staging and execution design.

This is concrete import-time remote code execution, not ordinary telemetry: opaque network-delivered bytes are directly executed. Absence of an npm lifecycle hook does not mitigate the au...

This is concrete import-time remote-code execution unrelated to the declared component package. The absence of install hooks does not mitigate execution on ordinary package use.

This is a concrete import-time staged payload execution chain, not telemetry: unverified remote bytes are written and executed without user action.

This is a concrete import-triggered remote-code-execution chain unrelated to the declared library functionality. Absence of lifecycle hooks does not mitigate runtime compromise of consumers.

The package has an import-time staged payload chain with no integrity validation and detached execution. The telemetry naming and opt-out variables do not align with its binary download-a...

This is concrete import-time remote code execution, not legitimate telemetry: no payload authenticity check is enforced and the downloaded binary is executed detached. Block publication.

The package has no legitimate SDK functionality beyond a minimal class, while import-time code performs covert remote binary staging and execution. This is a concrete arbitrary-code-execu...

The entrypoint makes remote payload execution import-time behavior, not an inert or user-invoked utility. Lack of lifecycle hooks does not mitigate arbitrary execution when an application...

This is concrete import-time remote payload execution unrelated to the advertised lightweight wrapper. No integrity verification or user action protects the downloaded executable.

This is concrete import-time remote payload execution with stealthy fallback infrastructure and detached persistence-like execution. The lack of an npm lifecycle hook does not mitigate th...

This package claims only helper methods, yet its import path implements a concealed remote binary loader and executor. The behavior creates a direct arbitrary-code-execution chain without...

This is concrete, automatically triggered remote payload execution unrelated to the advertised test utilities. Absence of install hooks does not mitigate import-time execution.

This is a concrete, silent remote-payload execution chain reachable through the package's normal entrypoint, not legitimate telemetry behavior. No install hook is required for the impact.

The behavior is reachable on ordinary import, uses obfuscated endpoint construction and DNS fallback, and executes unverified remote bytes. The absence of npm lifecycle hooks does not mit...

This is a concrete import-time staged-payload chain, not package-aligned telemetry. It enables arbitrary remote code execution without user action.

The manifest lacks install hooks, but the normal runtime entrypoint reaches an immediate remote payload loader. The source establishes concrete malicious behavior, not merely telemetry.

The import-time loader provides a direct, obfuscated download-and-execute chain with no user opt-in. Absence of lifecycle hooks does not mitigate execution when consumers import the decla...

This is a concrete import-time remote code execution chain disguised as telemetry and unrelated to the published adapter API. No lifecycle hook is needed because ordinary package consumpt...

The source establishes an import-time remote download-and-execute chain with no integrity validation. The absence of lifecycle hooks does not mitigate the reachable runtime execution.

The import-time remote payload execution chain is concrete and independent of lifecycle scripts. The large telemetry module contains the same downloader/launcher pattern but is not needed...