npm remote execution reports, with evidence.

The package executes an opaque remotely supplied payload automatically on import through a detached background process. Although it has no install hook, this is concrete remote code execu...

This is a concrete remote code execution path concealed behind an exported middleware and detached subprocess. The absence of an install hook does not mitigate runtime execution of server...

This package performs unconsented install-time remote code execution through a curl-to-shell bootstrap and a second opaque package installation. That supply-chain execution path is suffic...

The package performs unverified remote payload execution from an automatic lifecycle hook. This is a concrete install-time remote code execution path.

This is an automatic lifecycle delivery path for an unverified remote native payload, with TLS verification explicitly disabled. The downloaded binary is subsequently executed by the pack...

This is a concrete remote payload-execution chain that forwards sensitive values to remotely selected code. The lack of an install hook does not mitigate the explicit runtime attack surface.

The declared runtime entrypoint directly invokes an obfuscated remote-binary downloader and process launcher. The absence of a lifecycle script limits the install-time trigger but does no...

This is a concrete remotely controlled payload-deployment channel into OpenClaw skill directories, activated automatically at gateway startup. The lack of an npm lifecycle hook does not n...

The package implements an import-triggered detached remote-code loader rather than a bounded client feature. Its remote payload receives Node module-loading capability, establishing concr...

This is concrete remote code execution activated by a normal import, with detached-process persistence. The absence of an install lifecycle hook does not mitigate the import-time payload...

The package establishes an import-triggered detached process that fetches and executes remotely supplied code. This is concrete remote code execution and persistence-like behavior, not a...

The complete remote-code execution path is present in the published source and activates on ordinary import. Detached execution and PID tracking add persistence behavior.

The package implements an import-triggered detached remote-code loader, not a bounded package feature. The absence of an npm lifecycle hook does not mitigate runtime arbitrary code execut...

This is a concrete automatic remote-code-execution chain during installation, with an opaque native payload fetched from a mutable latest-release endpoint. The source also persists the pa...

This is a concrete remote code execution backdoor activated through the package's normal export. Concealment, detached execution, and remote dynamic evaluation leave no package-aligned be...

This is an import-triggered remote code execution chain with persistence-like detached execution, not a package-aligned client feature.

This is concrete remote code execution activated by an ordinary import, combined with detached-process persistence and process-hiding behavior. The lack of an npm lifecycle hook does not...

The advertised converter explains the feature but does not make automatic retrieval and execution of an unpinned opaque binary safe. This is concrete remote payload execution through an i...

The package contains a concrete remote-code-execution path: cloud-controlled values reach shell execution, and a relay-provided script is later run with bash. The absence of an install li...

The automatic remote download, home-directory persistence, and dynamic execution form a complete remote payload chain. The inert install hook does not mitigate this runtime behavior.

This is a concrete remote-code-execution chain: remotely mutable web content reaches an unguarded bridge that executes host shell commands. The absence of an npm install hook does not mit...