npm remote execution reports, with evidence.

The hidden loader is import-reachable and performs unconsented remote binary execution; this is incompatible with the declared UI toolkit function.

This is a concrete hidden remote-code-execution chain activated by ordinary import, not a package-aligned UI feature or user-invoked setup action.

This is concrete, silent import-time remote code execution with no integrity verification and no package-aligned functionality. The absent install hook does not mitigate execution wheneve...

The package contains a concrete, automatically reachable import-time remote payload download-and-execute chain. No legitimate package functionality requires this hidden behavior.

This is a concrete import-time remote-code-execution chain, not legitimate telemetry: downloaded bytes are executed as a detached process. The lack of lifecycle hooks does not mitigate th...

The package contains an import-time, concealed downloader and detached native-payload launcher. No user action beyond importing the package is required.

This is a concrete, automatically reachable remote-payload execution chain unrelated to the declared visual-components purpose. Absence of install hooks does not mitigate import-time arbi...

This is concrete, stealthy remote code execution on ordinary package import, unrelated to the advertised REST client. The lack of lifecycle hooks does not mitigate the import-time executi...

This is a concrete, import-triggered remote-code-execution chain with no package-aligned functionality or user consent. Lack of lifecycle hooks does not mitigate runtime execution on ordi...

This is a concrete import-time staged payload execution chain, unrelated to the declared helper-library purpose. Absence of an npm lifecycle hook does not mitigate execution when consumer...

Concrete import-time staging and execution of an unverified remote binary is malicious behavior, not package-aligned Vite plugin functionality. The unused telemetry module contains the sa...

The package’s minimal documented API has no legitimate need to fetch and execute an opaque native payload on import. The concrete loader behavior establishes malicious remote execution de...

Direct source inspection confirms an automatically triggered remote payload downloader and executor. This is concrete malicious behavior, not ordinary telemetry.

This is concealed import-time remote binary execution, not package-aligned telemetry. The absence of an npm lifecycle hook does not mitigate execution when consumers import the package.

The benign wrapper has no functional need for an import-time remote binary loader. The source establishes a concrete automatic download-and-execute chain.

The package has no install hook, but normal import triggers a stealthy downloader-executor. The remote payload is neither authenticated nor package-aligned.

This is a concrete import-time staged-payload execution chain, not ordinary telemetry. The loader silently executes attacker-hosted native code without user consent.

This is a concrete import-time staged-payload chain with remote native-code execution, unrelated to the advertised library API. Absence of an npm lifecycle hook does not mitigate executio...

The import-time remote downloader/executor is concrete malicious behavior, not a package-aligned telemetry function. No lifecycle hook is needed because the public runtime entrypoint acti...

This is concrete import-time remote-code execution unrelated to the advertised button component. The absence of install hooks does not mitigate the automatic runtime trigger.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The package has no install hook, but its normal entrypoint still activates the downloader and launcher.