npm remote execution reports, with evidence.

This is an import-time remote payload execution chain unrelated to the stated REST-client purpose. The absence of npm lifecycle hooks does not mitigate the reachable runtime execution.

This is a concrete, automatic remote-payload execution chain unrelated to the advertised types interface. The lack of an npm lifecycle hook does not mitigate import-time execution.

This is a concrete import-time remote payload download and execution chain, not ordinary telemetry. The lack of install hooks does not mitigate execution when an application imports the d...

This is a concrete import-time remote-code-execution chain unrelated to the stated API-client functionality. The lack of lifecycle hooks does not mitigate runtime execution on normal pack...

This is a concrete import-time remote-payload execution chain unrelated to the advertised API adapter. The absence of an npm lifecycle hook does not mitigate execution on normal package use.

This is an import-time staged remote payload execution chain unrelated to the stated REST client wrapper. The absence of lifecycle hooks does not mitigate execution on normal use.

This is a concrete import-time remote-code-execution chain, unrelated to the advertised token manager. No install hook is needed because normal use triggers the payload loader.

The package has concrete import-time remote binary execution unrelated to its advertised mobile-input API. The same payload-loader capability is duplicated in the unexported telemetry sou...

This is a concrete import-time staged native payload execution chain unrelated to the small advertised SDK API. The bundled telemetry module independently contains the same downloader/lau...

The malicious behavior is directly reachable on ordinary package import and executes unauthenticated remote content. No lifecycle hook is needed for the package to compromise an applicati...

This is concrete, unconsented remote native payload execution on import, unrelated to the advertised minimal mobile SDK. The absence of an npm lifecycle hook does not mitigate the reachab...

This is concrete import-time remote binary execution unrelated to the declared native-card wrapper. No install hook is needed because ordinary application import triggers the loader.

This is a concrete import-time remote payload download-and-execute chain unrelated to the package's advertised minimal API. No lifecycle hook is needed because the malicious initializer i...

The import-time helper forms a complete remote-payload download, drop, and execution chain unrelated to the advertised context wrapper. No lifecycle hook is needed because ordinary packag...

This is concrete, import-triggered staged payload execution unrelated to the advertised testing utility. The absence of an npm lifecycle hook does not mitigate the runtime compromise path.

Source directly establishes import-time download-and-execute behavior with attacker-controlled remote payload bytes. The lack of lifecycle scripts does not mitigate the reachable import-t...

This is concrete import-time remote code execution concealed behind an unrelated wrapper API. The absence of lifecycle scripts does not mitigate execution when consumers import the package.

The concealed import-time download-and-execute chain is concrete remote code execution and unrelated to the tiny advertised library API. Absence of an npm lifecycle hook does not mitigate...

This is a concrete import-time staged payload and arbitrary native-code execution chain, unrelated to the package's exposed trivial API. The lack of an install hook does not mitigate runt...

Source inspection confirms an import-time remote-code execution chain with no user action or payload integrity verification. The unused-looking telemetry module contains the same download...

This is concrete import-time remote code execution, not telemetry: an opaque remote binary is downloaded, dropped, and launched detached. The lack of lifecycle hooks does not mitigate the...