npm remote execution reports, with evidence.

This is concrete import-time remote payload execution unrelated to the declared semver API. Absence of an npm lifecycle hook does not mitigate the runtime RCE path.

This is concrete import-time remote payload execution with no integrity validation or user action beyond importing the package. Absence of an npm lifecycle hook does not mitigate the reac...

This is a concrete, automatic remote payload execution chain triggered by import, unrelated to the package's minimal exposed API. The large telemetry module contains the same capability p...

The package executes a remote, unauthenticated native payload during ordinary import and conceals failures/output. This is concrete malware behavior, not normal telemetry.

This is a concrete import-time remote code execution chain with no package-aligned purpose. The lack of lifecycle hooks does not mitigate execution on normal package use.

The package contains an import-time staged payload loader that remotely obtains and executes arbitrary native code without consent. This is concrete malicious behavior, not telemetry.

This is a concrete import-time remote-code-execution chain with no integrity validation or user action beyond loading the package. The unused telemetry module contains a substantially sim...

This is concrete import-time staged remote code execution unrelated to the documented mock-data functionality. The lack of an npm lifecycle hook does not mitigate execution when consumers...

This is a concrete import-time staged payload execution chain, not telemetry: the payload source is obfuscated, unverified, dropped to temp storage, and launched detached. The unused tele...

The behavior is concealed, unrelated to a code-style package, and remotely controlled at import time. Absence of npm lifecycle hooks does not mitigate this reachable execution chain.

This is a concrete import-time remote-payload execution chain unrelated to the stated UI package purpose. The absence of lifecycle hooks does not mitigate execution on ordinary package use.

The source establishes an import-time, obfuscated remote payload chain with direct eval and detached process execution. Absence of npm lifecycle hooks does not mitigate execution when the...

The install-time detached loader fetches and executes attacker-controlled remote code, which is concrete malicious behavior unrelated to an ESLint plugin.

The package has a concrete obfuscated, detached preinstall payload loader rather than package-aligned functionality. Its remote code execution path is directly established from source.

The advertised plugin is benign, but the preinstall bootstrap and obfuscated second stage establish concrete malicious install-time behavior.

Direct source inspection confirms an install-time staged execution chain and obfuscated remote-code-evaluation behavior. This is concrete malicious behavior, not a normal SDK dependency s...

Direct source inspection confirms a concealed preinstall payload with remote eval and credential-oriented logic. The ordinary SDK bundle does not justify this install-time behavior.

This package embeds an obfuscated, remotely extensible payload behind a preinstall hook; the UI SDK bundle does not explain that behavior. The concrete installation-time remote-code-execu...

The benign ESLint rule is accompanied by an unrelated, obfuscated preinstall payload that downloads a runtime, executes it, and evaluates fetched code. This is concrete malicious install-...

Concrete preinstall execution, downloader behavior, obfuscation, and runtime eval establish malicious install-time remote code execution.

The install-time loader is unrelated to the declared chart package and creates a concrete remote-code-execution chain with credential-access capability.