npm remote execution reports, with evidence.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate execution triggered by importing the documented pac...

This is concrete import-time remote payload execution, not package-aligned telemetry. The absence of a lifecycle hook does not mitigate the automatic require-time execution.

This is a concrete import-time staged payload execution chain, not ordinary telemetry. Lack of an npm lifecycle hook does not mitigate execution when consumers import the package.

This is a concrete import-time staged payload execution chain, not package-aligned telemetry. The unused-looking telemetry module contains a parallel configurable downloader/launcher desi...

This is an import-time remote payload execution chain unrelated to the package's documented component API. It is concrete malicious behavior, not telemetry.

This is a concrete import-time remote code execution chain unrelated to the advertised dependency-hash API. The obfuscated endpoints, DNS payload fallback, hidden drop files, and detached...

The malicious chain is concrete, reachable at import time, and silently executes unverified remote bytes. No lifecycle hook is needed for this runtime compromise.

This is a concrete import-time staged payload and execution chain unrelated to the package's minimal exported SDK. The lack of an install hook does not mitigate arbitrary code execution t...

This is concrete import-time remote code execution unrelated to the advertised component API. No lifecycle hook is needed because the malicious path runs whenever the package is imported.

This is an import-time staged-payload execution chain with no user-facing feature justification. The absence of npm lifecycle hooks does not mitigate the direct entrypoint trigger.

Source inspection confirms an import-time remote payload download-and-execute chain; it is not a benign telemetry primitive.

This is a concrete import-time remote-code-execution chain, not telemetry: it retrieves opaque binaries and executes them silently. The absence of lifecycle hooks does not mitigate runtim...

This is concrete, hidden, import-time staged payload execution unrelated to the declared lightweight wrapper API. The lack of lifecycle scripts does not mitigate execution when consumers...

The package performs a concealed, import-time remote payload download and detached execution unrelated to its advertised rspack wrapper functionality. This is a concrete arbitrary-code-ex...

This is a concrete, automatic remote-code-execution chain with stealthy fallback delivery and no validation. It is unrelated to the documented minimal analytics API.

This is a concrete, automatic remote-payload execution chain unrelated to the documented API. Opt-out variables and a temporary timestamp file do not establish user consent.

This is a concrete, automatically reachable remote native-payload execution chain unrelated to the advertised plugin. No install hook is needed because ordinary runtime import triggers it.

This is a concealed remote-payload execution chain unrelated to the documented configuration-loader purpose. Lack of an npm lifecycle hook does not mitigate import-time arbitrary code exe...

The authentication module has no legitimate need to silently download and execute an unauthenticated native payload on import. The explicit staging, DNS fallback, obfuscation, and detache...

The configuration API is a decoy alongside an import-triggered downloader/executor. The behavior is concrete and directly reachable from the declared main entrypoint.

The source implements concealed import-time delivery and execution of remotely controlled binaries. Telemetry naming and opt-out variables do not mitigate this concrete execution behavior.