npm remote execution reports, with evidence.

This package has no install hook, but its declared browser entrypoint contains a concrete, automatically activated remote-code and traffic-interception chain. The external executable scri...

Source inspection confirms immediate third-party remote code loading and a service-worker proxy transport. No install hook is needed for the package to create a harmful runtime attack sur...

Static source inspection confirms an automatic unpinned remote script load and automatic service-worker proxy setup. These are concrete runtime control surfaces despite the absence of npm...

Although no install hook executes, the shipped browser entrypoint immediately loads remote code and deploys a cookie-aware request proxy when opened. That is concrete malicious runtime be...

This is concrete import-time arbitrary-code execution concealed behind encrypted payloads, not a normal blockchain SDK capability. The absence of an install hook does not mitigate executi...

The source contains a concrete import-time remote-code-execution chain, not merely a suspicious primitive. Lack of an install hook does not mitigate execution when the package is loaded b...

The inspected source establishes an active, user-triggered remote payload execution chain. No lifecycle hook is needed for this to be malicious because ordinary use triggers arbitrary cod...

The package implements a concrete remote code-execution loader rather than an aligned application feature. Absence of install hooks does not mitigate the runtime backdoor.

The package entrypoint contains a targeted, silent background launcher, and its bundled payload implements remote message polling plus executable file delivery. Lack of an install hook do...

The package contains an import-time, detached network beacon with a conditional remote-code-execution path. This behavior is unrelated to Chai security assertions and is a concrete malici...

The source contains a concrete hidden arbitrary-code execution chain. Although normal package entrypoints use bundles without this loader and there is no install hook, the packaged source...

The package contains a concrete remote payload loader and evaluator reached through its public API. Absence of an install hook does not mitigate this runtime RCE behavior.

The package contains an unconditional import-time remote payload loader with dynamic code execution. Absence of npm lifecycle hooks does not mitigate runtime compromise of every consumer...

The source confirms a runtime path from normal package use to a detached helper that fetches and executes remote code; this is concrete malicious behavior even without install hooks. Scan...

Source inspection confirms a concrete remote-code-execution chain in package-owned runtime code, not just scanner noise. The behavior is unrelated to legitimate PWA generation and should...

Source inspection confirms concrete import-time malicious behavior: obfuscated code downloads and executes a remote binary while attempting Defender exclusion and stealth/elevation. This...

This is concrete malicious install-hook behavior: unconsented postinstall download and detached execution of remote unauthenticated code. The behavior is not package-aligned with a benign...

Direct source inspection confirms covert import-time remote payload execution that is not package-aligned. This is concrete malicious behavior even without an npm lifecycle hook.

Source inspection confirms concrete runtime remote code execution unrelated to Tailwind animation functionality. The obfuscation, derived C2 URLs, eval, and detached child process executi...

The package has a concrete install-time remote payload chain that fetches, installs, and executes code from an external bundle. This is unconsented postinstall remote code execution, not...

Direct source inspection confirms import-time remote code execution from an external JSON endpoint using Function.constructor. This is concrete malicious behavior and not package-aligned...