npm remote execution reports, with evidence.

The import-time downloader and detached execution chain is concrete remote code execution, unrelated to the advertised header abstraction. The telemetry-named code repeats the same payloa...

This is a concrete import-time remote-code-execution chain unrelated to the declared UI support module. The absence of npm lifecycle hooks does not mitigate execution on normal package im...

The public import path directly reaches unverified remote binary execution, unrelated to the package’s stated footer abstraction. This is concrete malware behavior, not ordinary telemetry.

This is concrete import-time remote payload execution, not package-aligned telemetry. The absence of lifecycle scripts does not mitigate execution on normal import.

This is a concrete import-time remote-code-execution chain unrelated to the declared UI-wrapper functionality. The lack of install hooks does not mitigate execution on normal package import.

Direct source inspection confirms an import-time remote payload loader and detached execution chain. The absent npm lifecycle hook does not mitigate the runtime compromise.

The import-time downloader and detached execution of unverified remote bytes are concrete malicious behavior, not telemetry. Lack of an npm lifecycle hook does not mitigate the runtime im...

The entrypoint-triggered loader provides a concrete remote code execution chain with no user action beyond importing the package. Its hidden network endpoints, temporary binary drop, and...

The package's advertised API is inert, while its unconditional import side effect implements an obfuscated remote executable loader. Absence of lifecycle hooks does not mitigate this runt...

The documented API is a minimal wrapper, while the import-time bridge implements a hidden remote binary loader and executor. This is malicious despite the absence of npm lifecycle hooks.

This is a concrete import-time staged-payload execution chain unrelated to the declared fonts functionality. Absence of lifecycle hooks does not mitigate the automatic runtime trigger.

This is a concrete import-time remote payload execution chain, unrelated to the stated package functionality. The lack of lifecycle hooks does not mitigate execution when an application i...

This is a concealed import-time remote code execution chain unrelated to the stated button-wrapper functionality. No install hook is needed because package consumption triggers the loader.

The package contains a concrete, import-reachable remote payload download-and-execute chain with obfuscated endpoints. This is malware, not package-aligned telemetry.

This is concrete import-time staged remote-code execution unrelated to the claimed slider functionality. Absence of an npm lifecycle hook does not mitigate execution when consumers import...

The malicious behavior is source-confirmed and reachable on ordinary import, despite no install lifecycle hook. The large telemetry module reinforces the same staged executable pattern.

The import-time remote binary staging and detached execution chain is concrete and requires no caller opt-in. The unused telemetry module contains a similar configurable loader, reinforci...

This is a concrete import-time staged payload loader and arbitrary code execution chain, unrelated to the advertised wrapper functionality. Absence of an npm lifecycle hook does not mitig...

This is a concrete import-time remote payload execution chain unrelated to the advertised component package. The unreferenced telemetry module contains substantially similar native-payloa...

The package's stated API does not require a native executable, yet import-time code silently downloads and executes one with no meaningful integrity verification. The remote payload sourc...

This is concrete import-time remote code execution, not a package-aligned telemetry implementation. The similarly capable telemetry module is not needed to establish the malicious chain.