npm remote execution reports, with evidence.

This is a concrete import-time remote code execution mechanism, not ordinary validation functionality. No install hook is needed because the main entry point starts the daemon automatically.

The package establishes a detached, import-time remote code execution path controlled by its signing-server operator. Its scanner-directed claim that signatures eliminate malware risk fur...

This package implements unprompted import-time remote code execution and persistence through a detached process. Signature verification does not remove the remote operator's ability to de...

This is concrete remote code execution on import from a hard-coded package-controlled endpoint. Signature verification authenticates the operator's payload but does not make arbitrary rem...

The exported hidden-SVG evaluator is a concrete arbitrary-code-execution capability and is not needed for SVG processing. Although it has no install hook or observed exfiltration, its del...

The package performs concealed, import-triggered download and execution of a Windows executable. The absence of an npm lifecycle hook does not mitigate this runtime arbitrary-code-executi...

This is a concealed remote-code-execution loader embedded in the package's import path, with self-removal intended to hide the compromise. The lack of an npm lifecycle hook does not mitig...

The import-time hidden downloader and executable payload runner are concrete malicious behavior. The absence of an install hook does not remove the import-time execution risk.

The package deliberately conceals a remote code loader in its runtime entrypoint. Its network-selected payload execution is concrete malicious behavior.

The package contains a concealed import-time loader that obtains and executes remote code, then persists it as a detached process. The absence of lifecycle hooks does not mitigate this di...

This is a concrete, obfuscated remote-code loader with an explicit eval and detached process launch. Although it is not install-time, its execution through the package test path is malici...

This is a concealed remote-code-execution loader embedded in a build configuration, unrelated to page asset extraction. The absence of an install hook does not neutralize execution throug...

The package contains a complete, obscured remote-download-and-execute chain activated by its primary API. The absence of an install hook does not mitigate this concrete runtime remote-cod...

This package contains a concealed remote code execution chain triggered by ordinary library use. The absence of an npm lifecycle hook does not mitigate the runtime download, hidden execut...

The package contains an automatic install-time remote payload loader that executes unaudited code from a hard-coded endpoint. This is concrete malware behavior, regardless of the benign-l...

The manifest contains a concrete, unconsented postinstall remote-code execution chain unrelated to the stated TOTP functionality. This is malicious install-time behavior.

The package contains an automatic install-time remote code execution chain that is unrelated to its advertised authentication utility. This is concrete malicious behavior and warrants blo...

The package contains a concealed import-time remote code execution payload unrelated to its advertised Tailwind functionality. No lifecycle hook is needed because normal loading of the ma...

The import-time obfuscated loader provides a concrete staged remote code-execution chain. It is not needed for the advertised Tailwind plugin behavior.

The manifest contains a concrete install-time remote code execution chain: download, write, and detached execution. This is unrelated to the declared TOTP utility and warrants blocking.

The package contains a postinstall downloader that immediately executes attacker-controlled remote code and attempts to remove the dropped file. This is concrete install-time malware beha...