npm remote execution reports, with evidence.

The import-time downloader/executor is concrete, stealthy, and unrelated to the package's stated visual-components purpose. The separate telemetry source contains the same remote-extensio...

The package has no install hook, but its normal import path executes a concealed downloader and launcher. The telemetry file independently implements the same payload-delivery pattern.

The advertised feature-toggle entrypoint has no need for an import-time remote binary bootstrap. The concrete downloader-to-temp-file-to-detached-execution chain is malicious.

This is a concrete, automatically reachable remote binary staging and execution chain concealed behind an unrelated DI package API. The absence of lifecycle scripts does not mitigate impo...

Direct source inspection confirms an import-time staged-payload downloader and detached executor, not merely telemetry transport. The lack of lifecycle hooks does not mitigate execution o...

The package's documented auth API is unrelated to its import-time remote binary loader. No lifecycle script is needed because ordinary package import triggers the execution chain.

This is a concrete import-time remote code execution chain, not legitimate telemetry. The large telemetry module contains a parallel implementation, reinforcing deliberate payload-loader...

This is a concrete import-time staged payload execution chain unrelated to the advertised cobrowsing interface. The lack of install hooks does not mitigate execution when consumers import...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The included telemetry module independently contains the same remote native-loader pattern.

Source directly establishes import-time remote payload retrieval and execution; no lifecycle hook is needed for the attack to trigger. The benign exported wrapper and lack of declared dep...

This is a concrete import-time staged-payload execution chain unrelated to the stated error-boundary library. Lack of lifecycle hooks does not mitigate execution when consumers import the...

Source directly establishes an import-time remote payload execution chain. The absence of an install lifecycle hook does not mitigate execution when the package is used.

The import-time remote payload execution chain is concrete and independent of install hooks. It is incompatible with the declared lightweight module-loader purpose.

Direct source inspection confirms an import-time staged payload loader with remote native execution. The absence of lifecycle scripts does not mitigate execution through the package main...

The package entrypoint reaches a concealed remote binary downloader and detached executor during import. No user action, configuration, integrity verification, or legitimate notifier func...

The package has a concrete import-time remote-code-execution chain with no consent, verification, or package-aligned purpose. Lack of npm lifecycle hooks does not mitigate this runtime tr...

This is a concrete import-time remote payload execution chain, not telemetry: downloaded bytes are written and executed without validation or user action. The benign-looking exported API...

This is a concrete, hidden import-time remote-code-execution chain unrelated to the advertised feature-toggle API. No install hook is required for the payload to execute once the package...

Direct source inspection confirms reachable import-time download-and-execute behavior with obfuscated infrastructure and no payload integrity verification. The lack of lifecycle hooks doe...

This is concrete import-time remote code execution, not normal module-loader behavior. The unused telemetry-like implementation in lib/telemetry.js reinforces the deceptive payload-loader...

This is a concrete, import-triggered staged payload loader and detached executor, unrelated to the documented query abstraction. Absence of install hooks limits the trigger to runtime imp...