npm remote execution reports, with evidence.

Static source inspection confirms import-time remote payload retrieval and execution concealed behind a date UUID package. This is concrete, non-package-aligned remote code execution, so...

Direct source inspection confirms a deterministic install-time reverse shell in package.json. This is concrete malicious behavior independent of the package's declared Paperclip adapter f...

Direct source inspection confirms a deterministic install-time reverse shell in package.json. This is concrete malicious behavior independent of the otherwise package-aligned Paperclip ma...

Direct source inspection confirms an automatic lifecycle hook implementing a hardcoded reverse shell. This is concrete malicious install-time remote code execution, not package-aligned be...

Static source inspection confirms unconsented import-time execution of a detached helper that retrieves and evaluates remote payloads. This is concrete malicious behavior, not merely a su...

Direct source inspection confirms a deceptive package-aligned facade with runtime remote code execution from an attacker-controlled endpoint. Lack of lifecycle hooks reduces install-time...

Source inspection confirms server-controlled remote code execution from a non-package-aligned host in a package that misrepresents its purpose. The lack of install-time execution lowers a...

Source inspection confirms import-time detached execution and network-loaded JavaScript execution unrelated to a Chai assertion plugin. The benign assertion API does not explain or justif...

Source inspection confirms a concrete remote code execution loader unrelated to the advertised package purpose. Absence of install hooks lowers automatic execution risk, but user-invoked...

Static source inspection confirms an attacker-controlled remote payload loader and executor reachable at runtime. Lack of install hooks lowers automatic install-time impact, but does not...

Source inspection confirms concrete malicious behavior: hidden detached execution of remotely fetched code unrelated to a React/DOM package or normal logger middleware. Lack of install ho...

Static source inspection confirms a hidden remote payload loader that executes server-supplied JavaScript with Node capabilities. Absence of install hooks only limits the trigger; it does...

Direct source inspection confirms a non-package-aligned remote fetch plus eval path in the CommonJS entrypoint, while benign SVG utilities do not justify this behavior. The package should...

Source inspection confirms concrete unconsented install-time remote code execution via a remote bundle and npm install/require chain. The behavior is not necessary for the advertised Kell...

Direct source inspection confirms unconsented install-time remote code execution with hardcoded external payload URLs, which is concrete malicious behavior. The benign date helper entrypo...

This is concrete malicious behavior: concealed import-time network retrieval, executable drop, and process launch unrelated to the package's declared multer functionality. The absence of...

Direct source inspection confirms an install-time detached remote-code loader with obfuscation and dynamic Function execution. This is concrete malicious behavior, not package-aligned Nod...

Direct source inspection confirms non-package-aligned network retrieval and dynamic execution in src/index.cjs, while the package claims zero-dependency SVG utilities. The behavior is not...

Source inspection confirms a reachable exported function in index.js fetches remote content and evals it, which is not package-aligned for a zero-dependency SVG helper. Although there is...

Direct source inspection confirms unpinned install-time download and execution of a mutable HTTP payload outside the npm package. That is concrete remote code execution behavior rather th...

Direct source inspection confirms import-time network retrieval and dynamic execution of remote response content. The behavior is unrelated to JWT decoding and creates concrete remote cod...