npm remote execution reports, with evidence.

This is an import-time remote payload loader, not ESLint configuration behavior. Its stealthy download, temporary staging, and detached execution constitute concrete malicious RCE.

The advertised state-store package has an undeclared, import-triggered remote native payload loader and executor. This is concrete malware behavior, not ordinary telemetry.

Source inspection confirms import-time remote payload retrieval and detached execution, not ordinary telemetry. The package should be blocked.

The package implements covert import-time remote payload staging and execution, not ordinary telemetry. The no-lifecycle manifest does not mitigate this runtime RCE path.

The package implements an unconsented import-time remote payload loader and launcher, not normal telemetry. No lifecycle hook is needed because the behavior activates whenever consumers i...

This is concrete, automatic remote code execution hidden behind purported telemetry in a React component package. The absence of an npm lifecycle hook does not mitigate import-time execut...

This is a concrete import-time remote code execution chain unrelated to the advertised ESLint/config package purpose. The absent npm lifecycle hook does not mitigate automatic execution o...

This is an import-time remote payload loader and executor, not ordinary telemetry. The opt-out and lack of npm lifecycle hooks do not mitigate the unconsented runtime execution chain.

Direct inspection confirms a reachable obfuscated npm-install-and-execute path in index.js. The absence of install hooks limits automatic activation but does not remove the concrete runti...

The advertised SVG-fetching purpose does not justify executing arbitrary code returned by an unrelated hard-coded host. This is a concrete remote-code-execution payload path despite lacki...

The package implements a remotely controlled execution and file-management agent against an unrelated hardcoded endpoint. Although it has no install hook and requires runtime activation,...

The package's sole runtime behavior is unvalidated remote-code retrieval and eval at import time. This is a concrete remote code execution chain, not merely a suspicious primitive.

The package is a minimal carrier for an unauditable remote dependency that automatically executes installation code. Static exports are benign but do not mitigate the install-time executi...

This is a concrete install-time remote code execution chain, not required by the documented monitoring functionality. The benign runtime implementation does not mitigate the postinstall l...

The package contains a concrete, automatic remote payload download and detached execution path on import. Its documented functionality provides no legitimate need for this behavior.

The import-time payload downloader and detached executable launch are unrelated to calendar bucketing and require no user action beyond importing the package.

The stated calendar/streak functionality does not require fetching and executing an opaque native binary. The behavior is concealed with character-code URL construction and runs automatic...

The package contains a concrete concealed remote-code execution chain unrelated to its advertised scaffolding function. Absence of an install hook does not mitigate execution when its ser...

This is a concrete, concealed remote-code-execution loader, not an SVG utility feature. Lack of install hooks limits automatic activation but does not remove the malicious capability.

The automatic, concealed runtime installation and execution of an unrelated dependency is concrete malicious behavior, not required for a Rollup polyfill plugin. No lifecycle hook is need...

The package’s import-time launcher directly executes a bundled Windows binary whose embedded strings demonstrate C2, command execution, persistence, and update behavior. This is concrete...