npm remote execution reports, with evidence.

This is concrete import-time remote code execution unrelated to the declared UI-tooltip functionality. No install hook is required for the attack to execute.

The package has a concrete import-time remote code execution chain, not merely suspicious telemetry primitives. The detached payload execution is concealed behind an unrelated UI API and...

This is a concrete import-time remote payload execution chain unrelated to the advertised React type/component package. The lack of install hooks does not mitigate execution on ordinary p...

This package has a reachable import-time unsigned remote-payload execution chain. The absence of lifecycle hooks does not mitigate execution when consumers import the package.

The documented foundational module has no legitimate connection to an import-time remote native-payload loader. The behavior is concrete, automatically reachable, and enables arbitrary co...

This is an import-time staged payload loader with remote binary execution, not legitimate telemetry. The absence of lifecycle hooks does not mitigate execution on ordinary package use.

This is concrete import-time remote payload execution, not legitimate utility behavior. The lack of an npm lifecycle hook does not mitigate runtime execution on require.

This is a concrete import-time remote code execution chain unrelated to the stated pluggable owners interface. Absence of npm lifecycle hooks does not mitigate execution when consumers im...

This is a concrete import-time staged-payload execution chain unrelated to the documented header library. The absence of an npm lifecycle hook does not mitigate arbitrary execution when c...

This is an import-time staged native payload execution chain unrelated to the package’s stated framework purpose. The absence of an npm lifecycle hook does not mitigate execution on norma...

This is concrete import-time remote payload staging and execution, with obfuscated fallback infrastructure and throttling. Absence of an npm lifecycle hook does not mitigate the reachable...

This is a concrete import-time remote payload execution chain unrelated to the package's documented menu API. The package is malicious even though it has no npm lifecycle hook.

The import-time loader provides a concrete, unconsented remote payload execution chain. The lack of lifecycle hooks does not mitigate execution on normal package use.

The package’s advertised authentication API has no legitimate need for an import-time, unverified remote binary downloader and detached executor. This is a concrete arbitrary-code executi...

This is a concrete import-time remote payload execution chain unrelated to a pagination component. Lack of lifecycle hooks does not mitigate the reachable runtime execution.

This is an import-time staged payload launcher unrelated to the declared UI package. The concrete download, drop, permission change, and detached execution chain warrants blocking.

The source establishes an import-time staged payload chain ending in detached execution of unauthenticated remote bytes. Lack of npm lifecycle hooks does not mitigate this runtime RCE path.

This is a concrete import-time remote-code-execution chain unrelated to the declared UI package purpose. Absence of lifecycle scripts does not mitigate execution on normal use.

Source directly confirms an import-triggered remote binary downloader and detached launcher; the lack of an npm lifecycle hook does not mitigate runtime import execution.

This is a concrete import-time remote-code-execution chain, not ordinary telemetry: fetched executable bytes are launched without validation. Lack of an install hook does not mitigate the...

The remote payload is not authenticated and is immediately executed on ordinary package import. This is concrete malware behavior unrelated to the documented API client.