npm remote execution reports, with evidence.

This is not a normal executable npm library: its HTML entry silently imports unrelated remote code and establishes browser interception/proxy infrastructure. The absence of install hooks...

Direct source inspection confirms automatic third-party remote code execution and an obfuscated proxy relay chain. Although npm installation alone has no lifecycle execution, the shipped...

The remote script tag is source-confirmed and automatically executes code controlled outside the package. Obfuscation and bundled browser interception support make this an unsafe staged r...

The package contains a concrete remote-code-execution chain, not merely network or process primitives. Absence of an install hook limits the trigger but does not mitigate runtime executio...

This is a concrete import-time remote-code-execution chain, not merely suspicious primitives. The hidden endpoint and token obfuscation, detached execution, and unrelated exported functio...

This is a concrete remote-code-execution chain unrelated to the declared package purpose. It is runtime-triggered rather than lifecycle-triggered, but remains malicious.

The unconditional remote script is sufficient concrete remote-code execution behavior at browser runtime; its behavior is not pinned or package-contained. Absence of lifecycle hooks reduc...

Direct source inspection confirms automatic remote code execution and service-worker proxy persistence when the package entrypoint is opened. These behaviors are unrelated to the package...

No install hook executes during npm installation, but the declared browser entrypoint contains a concrete third-party remote-code execution path and an opaque request-interception stack....

This is not merely a scanner signal: the manifest points to `index.html`, which directly executes an arbitrary remote script. The remote execution is sufficient for a blocking malicious v...

This is not an inert library artifact: its entrypoint executes remote, operator-controlled code and includes browser request-interception infrastructure. Absence of npm lifecycle hooks do...

The unconditional remote executable script is a concrete externally controlled payload channel, and the bundled service-worker proxy infrastructure expands its browser-side interception c...

The package contains a concrete remote-code loader and automatic persistent browser traffic-routing mechanism unrelated to its declared package identity. Although it has no npm install ho...

No install-time hook exists, but the shipped entrypoint directly executes unpinned remote code and installs a browser request-interception proxy that forwards request data to an unrelated...

No install-time host mutation occurs, but automatic unpinned third-party code execution is a concrete malicious supply-chain attack surface. Obfuscation and the bundled traffic-intercepti...

Source inspection confirms browser-side remote payload execution and a persistent service-worker proxy path, not merely scanner-observed obfuscation. Although installation itself has no l...

This is a republished npm package whose HTML entry embeds remote executable code and activates a service-worker traffic proxy to unrelated external infrastructure. The runtime behavior is...

Direct source inspection confirms automatic third-party code execution and a service-worker proxy with unrelated remote infrastructure. The absence of npm lifecycle hooks limits install-t...

Direct source inspection confirms automatic execution of an unpinned external script plus obfuscated fingerprinted network behavior. This is a concrete browser-side remote payload executi...

The source establishes an automatic remote code-execution path in the packaged entry page, compounded by automatic service-worker/proxy setup. No install hook is required for the maliciou...

The package has no install-time hook, but its declared runtime entrypoint directly executes third-party remote code and installs an intercepting service-worker proxy. That is concrete mal...