npm remote execution reports, with evidence.

Source directly establishes an import-time remote payload download and detached execution chain. The lack of an install hook does not mitigate runtime arbitrary code execution when consum...

The package has a concrete, import-time remote-code-execution chain unrelated to its stated mobile SDK API. No install hook is needed for the payload to execute when the module is loaded.

This is a concrete import-time remote-code-execution chain unrelated to the advertised React UI components. Absence of an npm lifecycle hook does not mitigate runtime import execution.

Confirmed source behavior is an import-triggered remote binary downloader and executor, not package-aligned telemetry. The unused/parallel telemetry implementation repeats the same payloa...

The package’s documented wrapper has no legitimate need to execute opaque remote binaries on import. The behavior is concrete, automatic, stealthy, and provides remote code execution.

The package contains a concrete, stealthy import-time downloader and executor of remote native payloads. The absence of an npm lifecycle hook does not mitigate runtime compromise when con...

This is a concrete import-time remote-code-execution chain unrelated to the advertised UI package. The absence of lifecycle hooks does not mitigate execution when consumers import the pac...

This is a concrete import-time remote-code-execution chain unrelated to the advertised visual-component package. Absence of lifecycle hooks does not mitigate the automatic runtime trigger.

This package contains a reachable, import-time remote payload download-and-execute chain. No install hook is needed for the behavior to affect any application that imports it.

This is an import-time staged remote-code-execution chain unrelated to the advertised UI loader, with concealed endpoints and no payload verification.

This is a concrete import-time remote payload execution chain unrelated to the declared React-components purpose. The absence of lifecycle hooks does not mitigate runtime execution on imp...

The import-time loader is a concrete remote native-code execution chain unrelated to the advertised UI component package. It is sufficient for a blocking malicious verdict.

This is concrete import-time remote payload execution, not package-aligned UI functionality. The lack of lifecycle hooks does not mitigate execution whenever the advertised module is loaded.

The import-time bootstrap provides a concrete, unconsented remote payload execution chain unrelated to the advertised UI component. No lifecycle hook is required for exploitation because...

The package has a concrete import-time remote-binary execution chain. Its obfuscation, temporary payload staging, DNS fallback, and detached launch establish malicious intent.

This is a concrete, automatic import-time remote-code-execution chain, not merely telemetry functionality. Absence of an install hook does not mitigate execution when consumers import the...

This is concrete, automatic remote native payload execution unrelated to the advertised UI slider. Absence of lifecycle hooks does not mitigate import-time execution.

This is a concrete, import-time remote code execution chain unrelated to the stated visual-components purpose. Absence of an install hook does not mitigate execution on normal package use.

The import-time downloader/executor is a concrete remote-code-execution chain unrelated to the declared visual-components package. The unused telemetry file reinforces the same pattern bu...

Source inspection confirms an import-time staged payload downloader and executor, not merely telemetry. No lifecycle hook is needed because index.js triggers it whenever the package is lo...

This is concrete import-time remote code execution unrelated to the stated UI-table functionality. The lack of lifecycle hooks does not mitigate the automatic entrypoint trigger.