npm remote execution reports, with evidence.

Confirmed import-time remote-code execution is concrete malicious behavior, not a path-module feature. No install hook is needed because normal package use activates the payload.

Source establishes a concrete remote payload execution chain, not merely suspicious APIs. The absence of install hooks does not mitigate execution once the exported middleware is used.

The source contains an active remote JavaScript loader, not merely suspicious dependencies or unused primitives. Absence of install hooks does not mitigate runtime remote code execution.

Direct source inspection confirms unconsented remote command-and-control behavior, arbitrary shell execution, and command-output exfiltration. The standard native-build install hook enabl...

The package implements concrete, automatic C2-driven arbitrary command execution and exfiltrates command results to a hard-coded remote host. The native addon duplicates this behavior beh...

Direct source inspection confirms an install-time persistent backdoor with npm-based command-and-control, arbitrary command execution, and data exfiltration. This is concrete malicious be...

The package contains an unconsented preinstall hook that retrieves and executes mutable remote code. This is concrete malicious install-time behavior.

This is concrete install-time remote code execution, obscured to avoid ordinary review. The benign table-formatting entrypoint does not justify the lifecycle behavior.

The package contains a concrete, obfuscated preinstall remote payload loader rather than a package-aligned feature. This establishes malicious install-time arbitrary code execution.

This is a concrete remote-code-execution loader, not a benign font-fetching implementation. Lack of install hooks reduces automatic activation but does not remove the malicious runtime at...

This is a concrete staged remote-code-execution path, not merely a static `eval` hint. Although it is not install-time, the exported package API directly executes attacker-controlled netw...

Direct source inspection confirms an unconsented install-time persistent C2 agent with arbitrary shell execution and data export. This is concrete malicious behavior, not a package-aligne...

Source inspection confirms an install-time remote-command agent with persistence and npm-based output exfiltration. This is concrete malicious behavior, not a scanner-only inference.

The package contains an automatic preinstall hook that executes remotely hosted content through `mshta`. This is concrete malicious behavior, not merely a suspicious primitive.

Direct inspection confirms concrete malicious install-time remote command execution, persistence, credential configuration mutation, and output exfiltration via npm publishing.

Source inspection confirms an unconsented install-time remote binary download and hidden execution. The utility exports are a cover for the lifecycle payload.

Direct source inspection confirms a concrete install-time remote executable download and hidden execution chain. The platform and environment guards reduce exposure but do not make the be...

Direct source inspection confirms a platform-gated postinstall chain that downloads and executes a remote executable invisibly. The benign exported utilities do not justify this behavior.

Direct source inspection confirms an unconsented install-time remote executable download and hidden execution chain. This is concrete malware behavior, not a package-aligned setup action.

This is a concrete import-time remote-code-execution chain, not a normal request helper. The hard-coded network payload is executed without user action or integrity verification.

This is a concrete browser-side remote payload chain rather than a benign utility: it automatically obscures the host UI and hands control to an external page. No lifecycle hook is needed...