npm remote execution reports, with evidence.

The package contains concrete, unconditional remote-code execution at import time. Its inert-canary documentation is contradicted by the source.

Despite inert-canary comments, the source contains concrete import-time remote code execution. No install hook is needed for this to be malicious.

The concealed remote payload execution path is unrelated to the advertised SVG utility and creates concrete arbitrary code execution. Lack of lifecycle hooks limits automatic activation b...

The decoded, hidden install and immediate execution of an undeclared package are concrete malicious behavior, not polyfill functionality. Absence of a lifecycle hook does not mitigate imp...

The import-time hidden package installation and execution are concrete malicious behavior, not required for the declared polyfill functionality. The ESM entrypoint’s absence of this code...

The CJS entrypoint implements a concealed remote payload loader and executor unrelated to SVG processing. No lifecycle hook is needed for this concrete runtime RCE capability to be malici...

The entrypoint contains a concrete, obfuscated import-time chain that installs and executes an undeclared remote package. No lifecycle hook is needed for this behavior to affect consumers...

This is a concrete remote code-execution loader, not package-aligned icon functionality. Absence of an install hook does not mitigate the runtime execution path.

Source inspection confirms a concealed remote-code-execution path in src/index.cjs. It is not install-time, but it is concrete malicious functionality rather than a package-aligned feature.

The package is a staged remote-code-execution loader, not a normal icon fetcher. The absence of lifecycle hooks limits automatic activation but does not remove the concrete runtime attack...

This is a concrete remote-code-execution loader unrelated to the documented mutex functionality. Lack of lifecycle hooks does not mitigate execution when the exported API is called.

This is a concrete remote-code-execution loader, not a package-aligned API implementation. Lack of an install hook limits automatic activation but does not remove the malicious runtime be...

The remote, concealed, dynamically compiled payload is a concrete remote-code-execution mechanism, not ordinary database connectivity. Lack of an install hook limits automatic activation...

The advertised utility package contains an undocumented remote code loader whose payload is controlled by a hard-coded external endpoint. Although it is not install-time execution, this i...

This is a concrete staged remote-code-execution mechanism, not a benign CDN fetch. Lack of automatic invocation reduces reachability but does not remove the malicious capability exposed b...

Source establishes a concrete remote-code-execution path when an exported API is called. Absence of lifecycle hooks reduces install-time scope but does not remove the malicious runtime ca...

The code implements a remote, server-controlled payload loader with full Node process access. Lack of automatic import or install execution limits triggering but does not remove the concr...

The concealed runtime install and execution are unrelated to SVG validation and constitute a concrete malicious execution chain. Lack of an npm lifecycle hook limits activation to explici...

This is a concrete remote-code-execution loader, not a normal resource fetcher. Lack of an install hook limits activation to runtime, but does not remove the malicious execution chain.

This is a concrete install-time fingerprinting and remote-code-execution chain unrelated to a React Native toast library. The fake integrity verification provides no meaningful protection.

This is concrete, concealed install-time download-and-execute behavior unrelated to a React table UI. The benign runtime bundle does not mitigate the preinstall RCE.