npm remote execution reports, with evidence.

The import-time loader implements an unconsented remote native-payload execution chain. No install hook is required because ordinary package import triggers it.

Source inspection confirms an import-time, silent remote payload execution chain unrelated to the package's stated shared-primitives purpose. The absence of npm lifecycle hooks does not m...

The package’s normal import path performs stealthy remote payload retrieval and execution, with no user action or documented need. Obfuscated endpoint construction, DNS fallback, temporar...

Source inspection confirms a reachable import-time remote payload download-and-execute chain. The absence of lifecycle hooks does not mitigate execution when consumers import the package.

The source establishes a reachable, import-time download-and-execute path with attacker-controlled remote payload bytes. Lack of an install hook does not mitigate runtime execution when c...

The malicious chain is directly reachable from the main entrypoint and needs no install hook or explicit user command. The package’s stated state-container purpose does not justify arbitr...

Direct source inspection confirms a concrete, silent import-time remote binary download and execution chain. The absence of npm lifecycle scripts does not mitigate runtime execution when...

This is a concrete import-time staged payload downloader and executor, not package-aligned telemetry. The analogous native-extension loader in lib/telemetry.js reinforces the intended rem...

This is an import-time, unauthenticated remote binary execution chain with stealthy host obfuscation and DNS fallback. It is concrete malware behavior, not telemetry required by the state...

Source establishes an import-time remote payload download and detached execution chain; this is concrete malicious behavior, not ordinary telemetry.

Source inspection confirms a reachable staged payload loader and executor, not ordinary telemetry. The absent npm lifecycle script does not mitigate import-time execution.

The package's advertised HTTP wrapper has an import-time, concealed remote binary execution chain unrelated to its stated function. This is concrete malware behavior, not merely telemetry.

Concrete import-time remote payload execution is present in source, with no user opt-in or legitimate package-aligned purpose. This is malware, not merely telemetry.

Direct source inspection confirms an import-time staged-payload loader with silent detached execution. The absence of an npm lifecycle hook does not mitigate the reachable runtime attack.

Source inspection confirms an automatic, obfuscated download-and-execute chain reachable on normal import. The lack of an install hook does not mitigate import-time arbitrary payload exec...

This is a concrete import-time remote download-and-execute chain unrelated to the stated Svelte adapter functionality. No lifecycle hook is needed because normal package use triggers it.

This is a concrete import-time remote payload download-and-execute chain unrelated to the stated declaration-generator functionality. The lack of lifecycle hooks does not mitigate executi...

This is concrete import-time staged payload execution with obfuscated endpoints and no payload verification. The absence of lifecycle hooks does not mitigate execution during ordinary pac...

The public entrypoint reaches a concealed remote binary downloader and detached launcher without user action. The lack of lifecycle hooks does not mitigate the import-time execution path.

The documented package role is a configuration loader, but its import path immediately performs covert remote native payload execution. This is concrete malware behavior, not a benign tel...

The import-time loader establishes a concrete remote-payload execution chain. The unused telemetry module contains materially similar downloader/executor logic, reinforcing intent.