npm remote execution reports, with evidence.

The package embeds a concealed remote-code loader with disabled TLS validation, despite presenting itself as a small SVG utility. No lifecycle hook is needed for the concrete user-trigger...

A hidden preinstall download-and-eval chain is concrete malicious remote-code-execution behavior unrelated to a table library. The non-executable file mode may prevent activation in this...

This is a concrete install-time remote-code-execution chain concealed with Base64 and eval. The normal library entrypoints do not justify it.

This is a concrete, unconsented preinstall remote-code-execution chain, hidden by Base64 encoding. The package should be blocked.

Source inspection confirms a concrete remote-code-execution path, albeit user-invoked rather than lifecycle-triggered. The hard-coded endpoint and deceptive package functionality support...

The package contains a concrete, remotely controlled arbitrary-code execution path unrelated to its stated Tailwind/forms purpose. Lack of an install hook limits automatic activation but...

The package contains a concrete remote code execution loader with a hard-coded, non-package-aligned IP endpoint. Lack of an install hook limits automatic execution but does not remove the...

This is a concrete remote-code-execution loader, not a legitimate icon fetch path. Lack of lifecycle hooks limits automatic activation but does not remove the malicious exported capability.

The runtime entrypoint loads a concealed payload with command-execution and outbound-request primitives that are not package-aligned. Lack of an install hook does not mitigate import-time...

The package contains a concrete remote-code loader with broad Node capabilities and misleading helper/icon framing. No lifecycle hook is needed for the malicious behavior once its exporte...

The source contains a concrete, user-triggered remote code execution chain with no integrity or trust validation. Lack of install hooks limits automatic activation but does not make the e...

The package is a concrete remote code execution loader, not a normal API client: its only exported behavior retrieves and executes server-provided code. The documented API does not match...

The hidden import-time payload and concealed host/process capability are concrete malicious behavior, not package-aligned functionality. Absence of an install hook does not mitigate execu...

The source establishes a concrete import-time hidden payload with process execution and network capability; no legitimate package function accounts for it. Absence of lifecycle hooks limi...

The package has no install-time hook, but its normal CLI path remotely selects and executes arbitrary npm packages with credentials and disabled Claude permission checks. That is a concre...

The package contains a concrete server-controlled Node.js code-execution path unrelated to its stated purpose. Lack of an install hook limits automatic activation but does not remove the...

The package contains a concrete, automatically triggered remote execution chain with stealth and system-modification behavior unrelated to its stated WordPress functionality. Empty Telegr...

This is a concrete import-time remote command execution chain, not a package-aligned CSS-processing feature. Lack of an install hook does not mitigate execution when the package is import...

The package's advertised transformer functionality is absent, while its automatic lifecycle hook retrieves and executes a remotely controlled payload. This is concrete install-time remote...

The package contains a concrete, automatically triggered hidden child-process payload unrelated to its advertised testing functionality. The added dependency and suppressed child output r...

The package contains an unrelated, concealed child-process payload invoked during normal plugin initialization. Its missing `spawn` import makes the attempt fail in standard Node, but doe...