npm remote execution reports, with evidence.

The package contains a concrete, import-time arbitrary native payload execution chain. Its benign exported logger does not mitigate the hidden loader.

The import-time downloader and detached execution form a concrete remote-code-execution chain, independent of npm lifecycle hooks. The larger telemetry file contains a similarly capable c...

This is a concrete import-time remote-code-execution chain, not merely telemetry. The lack of an npm lifecycle hook does not mitigate execution when consumers import the package.

The import-time remote payload execution is concrete and unrelated to the minimal advertised SDK. Its detached execution chain creates direct arbitrary-code-execution risk.

This is concrete, unconsented runtime remote code execution unrelated to the package's stated subscription-holder API. Absence of lifecycle hooks does not mitigate import-time execution.

The import-time loader is unrelated to the advertised storage API and forms a concrete remote-code-execution chain. No lifecycle hook is needed because normal application use activates it.

This is a reachable import-time staged binary loader with remote execution, unrelated to the stated test-harness API. The lack of an install hook does not mitigate the concrete runtime ex...

The advertised abstraction has no need for an import-time remote executable loader. The concrete network-to-disk-to-detached-process chain is malicious remote code execution.

This is concrete import-time remote payload execution unrelated to the declared toast interface. The absence of lifecycle hooks does not mitigate the reachable import trigger.

This is a concrete import-time remote payload execution chain unrelated to the package’s advertised minimal claims-domain API. No lifecycle hook is needed for it to execute in consumers.

Direct source inspection confirms an import-time remote payload execution chain, not merely telemetry primitives. The absence of npm lifecycle hooks does not mitigate execution on normal...

This is a concrete import-time remote-code-execution chain unrelated to the package's stated base-URL wrapper function. The absence of an npm lifecycle hook does not mitigate execution wh...

This is a concrete import-time remote payload execution chain unrelated to the declared money-format interface. The lack of an install hook does not mitigate arbitrary execution whenever...

The malicious loader is import-reachable and performs unverified remote payload execution without user consent. Lack of npm lifecycle hooks does not mitigate runtime compromise.

The benign-looking exported API is a wrapper around import-time remote payload execution. The telemetry file contains the same downloader/runner pattern but is not needed to establish the...

This is an import-time remote code execution chain unrelated to the stated API-client purpose. The lack of an npm lifecycle hook does not mitigate execution on ordinary package import.

The package's advertised adapter entrypoint has no legitimate need to silently retrieve and execute opaque remote binaries. The executable chain is directly reachable on import and is con...

This is a concrete import-time remote payload execution chain, not telemetry. The large telemetry file contains the same payload-hosting primitive, while _bridge.js makes it immediately r...

This is an import-time staged remote-code-execution chain unrelated to the advertised API client wrapper. The lack of lifecycle hooks does not mitigate execution on ordinary package import.

The import-time loader is concrete remote payload execution, not package-aligned API behavior. Telemetry code independently contains the same download-and-launch primitive.

The package contains an import-time downloader and detached executor for remotely supplied native payloads. No legitimate package functionality requires this behavior.