npm remote execution reports, with evidence.

Source is a fake Cloudflare challenge whose obfuscated script fetches, AES-CTR decrypts, and Function-executes a remote payload, then redirects the visitor. That is a concrete browser rem...

Source shows a random-named HTML dropper that impersonates Cloudflare, contacts a reconstructed API, decrypts the reply, and executes it with Function. That is a concrete browser remote-c...

Source shows a fake Cloudflare interstitial whose obfuscated script fetches, decrypts, and Function-executes a remote payload. Missing install hooks only means npm will not auto-open the...

index.js is a reverse-shell dropper on the published main export, with check.js and CI invoking it. That is concrete remote code execution, not dual-use tooling.

The install hook downloads and installs an unverified native binary from a raw IP while disabling TLS checks, which is a concrete remote payload dropper. The launcher then executes that b...

Importing the package runs a packed dropper that collects host identity, talks over axios, and executes decoded code with Function and execSync. The Pino-looking docs and empty middleware...

This is a concrete remote code execution path in the package's exported runtime artifact, with no integrity control over the downloaded JavaScript. The absence of an npm lifecycle hook do...

This is a typosquat of the official Tailwind PostCSS plugin with a hidden SVG-comment loader. On plugin run it decodes and executes arbitrary JavaScript from project SVG files, which is c...

The package contains a concrete server-directed arbitrary JavaScript execution path in customer web pages, alongside automatic host traffic and DOM collection. The absence of install hook...

The package contains a reachable remote-code execution path: it downloads and evaluates JavaScript at runtime. The absence of install hooks reduces install-time risk but does not remove t...

The source establishes a complete remote-response-to-dynamic-execution path. Although it is not install-time behavior and appears product-related, executing service-supplied code in a con...

This is a concrete import-triggered remote code execution and persistence mechanism, not a package-aligned utility. The absence of an install hook does not mitigate execution on ordinary...

src/index.js is an obfuscated Ethereum-backed dropper that evals and spawn-executes recovered code on plugin import, while the README, types, and repository metadata impersonate a Tailwin...

This is a concealed remote code execution chain unrelated to a Tailwind forms plugin. The absence of install hooks does not mitigate execution on normal package import.

This is a concrete remote code execution path coupled to global AI-agent hook installation and instructions designed to suppress inspection. The absence of an npm lifecycle hook does not...

The package contains an import-time detached remote-code execution chain unrelated to its advertised utility purpose. This is concrete malicious behavior even without an npm lifecycle hook.

This is concrete credential exfiltration and remotely controlled code execution on import. The Base64 endpoint encoding further conceals the behavior.

The package's install hook automatically executes an unpinned remote native payload and mutates an agent-related user configuration through that payload. This is concrete install-time rem...

This is a concrete remote-code-execution loader activated by a normal import, with persistence-like detached process behavior. The lack of an install hook does not reduce the import-time...

The package contains a reachable remote-code loader that executes unverified network content. This is a concrete remote code execution surface despite the absence of install-time hooks.

This is a concealed import-time remote code execution chain with self-modification, unrelated to a Tailwind forms plugin. The absence of an install hook does not mitigate execution throug...