npm remote execution reports, with evidence.

This is concrete import-time remote code execution, not ordinary telemetry: unverified remote bytes are silently executed as a detached process. The absence of an npm lifecycle hook does...

The import-time downloader-and-executor in setup.js is a concrete malicious remote-code-execution chain, regardless of the absence of an npm lifecycle hook. lib/telemetry.js independently...

This is a concrete, automatically reachable remote-code-execution chain unrelated to the package's stated DI interface. Absence of install hooks does not mitigate import-time payload exec...

This is concrete import-time remote payload execution unrelated to the advertised UI toolkit. No lifecycle hook is needed because the package main entrypoint reaches the bootstrapper.

The package's simple data-table API does not require binary downloading or execution. Source confirms the dangerous chain is import-time, concrete, and not merely a scanner label.

This is a concrete, import-triggered remote payload execution chain rather than ordinary telemetry. The lack of an npm lifecycle hook does not mitigate execution on normal package use.

This is a concrete import-time staged remote-code-execution chain unrelated to the advertised handler API. The absence of an npm lifecycle hook does not mitigate execution on normal packa...

The package's documented utility entrypoint triggers concealed remote payload download and execution without user action. No legitimate package-aligned use explains this behavior.

Direct source inspection confirms reachable import-time remote payload execution, not merely telemetry behavior. The dormant telemetry module contains a similar downloader, reinforcing in...

This is concrete import-time remote payload execution unrelated to the advertised client abstraction. Opt-out environment checks and lack of an npm lifecycle hook do not mitigate the runt...

The package's claimed UI interface does not need an import-time remote binary loader. This is a concrete hidden remote-code-execution chain, not ordinary telemetry.

This is concrete import-time staged remote-code execution unrelated to the advertised minimal SDK. The source directly establishes payload retrieval, disk drop, and detached execution.

This is a concrete import-time remote-code-execution chain unrelated to the stated product-list API. The similarly structured telemetry module reinforces the payload-loader behavior, but...

This is a concealed import-time downloader and launcher unrelated to the advertised abstraction library. The absence of an npm lifecycle hook does not mitigate the concrete remote-code-ex...

This is concrete, stealthy remote payload execution on ordinary package import, unrelated to the advertised status API. Absence of an npm lifecycle hook does not mitigate import-time exec...

This is a concrete import-time remote payload execution chain unrelated to the stated adapter functionality. The absence of lifecycle hooks does not mitigate execution when consumers load...

The package contains an import-triggered, unauthenticated remote-payload execution chain with no legitimate relationship to its documented API. Lack of an install hook does not mitigate r...

This is concrete import-time staged remote code execution, unrelated to the package's minimal documented SDK API. The lack of lifecycle hooks does not mitigate the reachable runtime paylo...

This is concrete import-time remote code execution, not package-aligned telemetry: the payload is opaque, unverified, concealed behind obfuscated domains, and launched detached.

Direct source inspection confirms import-time remote payload retrieval and execution, independent of scanner labels. The same loader pattern is also present in lib/telemetry.js, although...

Source directly establishes import-time retrieval and execution of an unverified remote native payload; no legitimate SDK behavior requires this concealed loader.