npm remote execution reports, with evidence.

This is a concrete import-time remote payload execution chain unrelated to the documented abstraction API. The lack of lifecycle hooks does not mitigate execution on ordinary package import.

The package's main entrypoint performs import-time download-and-execute behavior unrelated to its stated reactive-store purpose. No lifecycle hook is needed because ordinary package use t...

This is concrete import-time remote code execution, not package-aligned telemetry. No lifecycle hook is needed because requiring the declared main entrypoint activates the loader.

This is a concrete import-time staged-payload execution chain unrelated to a navigation router. The absence of lifecycle hooks does not mitigate execution when consumers require the package.

Source directly establishes an automatic remote-payload download-and-execute chain. No install hook is needed because normal runtime import activates it.

Concrete source shows unconsented import-time download-and-execute behavior with obfuscated endpoints and no legitimate uploader implementation. Absence of lifecycle scripts does not miti...

This is a concrete, automatic remote-code-execution chain on package import, unrelated to the advertised lightweight SDK interface.

This is a concrete import-time staged payload execution chain, unrelated to the stated select-fields functionality. The lack of an npm lifecycle hook does not mitigate execution on normal...

This is concrete import-time remote payload execution, not package-aligned version-checking or benign telemetry. Lack of lifecycle hooks does not mitigate execution when the documented im...

This is concrete import-time staged payload delivery and execution, not legitimate package-aligned telemetry. Lack of an npm lifecycle hook does not mitigate runtime compromise of consumers.

The package’s benign exported class is paired with an unconditional import-time downloader/executor. The remote opaque binary is neither package-aligned nor integrity-verified despite a m...

Direct source inspection confirms an import-time remote payload downloader and launcher; the benign-looking API does not invoke or document it. This is concrete malware behavior, not ordi...

This is concrete import-time remote payload execution, not a package-aligned utility feature. The absent install hook does not mitigate execution on ordinary use.

The package's import path directly activates an obfuscated remote binary downloader and executor. The absence of an install hook does not mitigate runtime compromise on normal import.

This is a concrete import-time remote payload execution chain, not legitimate package-aligned telemetry. The absence of lifecycle hooks does not mitigate execution on normal package use.

This is a concrete import-time staged-payload execution chain unrelated to the package’s stated interface. Absence of an npm lifecycle hook does not mitigate execution on normal module im...

The remote payload is not package-aligned application functionality and is executed automatically on import, making this a concrete arbitrary-code execution chain.

Direct source inspection confirms an import-triggered staged payload downloader and executor. Lack of lifecycle hooks does not mitigate runtime arbitrary code execution.

The package has a concrete import-time remote payload execution chain, not merely telemetry primitives. Absence of lifecycle scripts does not mitigate execution when normal package import...

This is concrete import-time remote payload execution, not legitimate telemetry: the package's public API is inert while the hidden side module downloads and launches an opaque binary.

This is a concrete import-time staged payload downloader and execution chain unrelated to the advertised shared-utilities package. The lack of lifecycle hooks does not mitigate execution...