npm remote execution reports, with evidence.

Published entrypoints contain an import-time staged payload launcher that decrypts externally supplied code and executes it detached. This is concrete arbitrary code execution and is unre...

The package contains import-time remote code execution through eval, which is a concrete malicious execution chain. The absence of lifecycle scripts does not mitigate runtime compromise o...

This is an import-time remote code execution loader with an intentionally obscured endpoint. It is concrete malicious behavior, regardless of the absence of lifecycle scripts.

This is a concrete install-time remote code execution chain, not a package-aligned runtime feature. The endpoint response is executed without validation.

This is a concrete install-time remote-code-execution chain, not a package feature. The mismatched README further supports deceptive intent.

This is a concrete credential-exfiltration and remote-code-execution chain activated by ordinary package use. Lack of an install hook does not mitigate the import-time attack.

Direct inspection confirms concrete install-time remote shell access, not merely a suspicious primitive. This is malicious behavior with no user action required beyond installing the pack...

This is concrete install-time remote code execution, not merely a dynamic-evaluation primitive. Block publication.

Direct source inspection confirms an install-time remote-code-execution chain. The remote payload is dynamically evaluated and is not constrained to a package-aligned static asset.

The package's import-time side effect is unrelated to its advertised assertion API and silently installs and executes another package with remote configuration. This is a concrete malicio...

This is concrete, unconsented import-time execution that globally installs and runs an unrelated package with an external endpoint. Absence of an npm lifecycle hook does not mitigate the...

The distributed main entrypoint contains an obfuscated, import-triggered remote payload loader unrelated to the package’s stated functionality. Absence of lifecycle hooks does not mitigat...

Concrete import-time staged payload execution is present, even though no install hook exists. The dynamic HTTP transport is not needed for the verdict.

Direct inspection confirms a concealed staged-payload loader with eval and detached process execution in the ESM runtime path. Absence of lifecycle hooks does not mitigate this applicatio...

The package contains a concrete, obfuscated import-time remote payload execution chain. Lack of npm lifecycle hooks does not mitigate the ESM import path.

The ESM runtime entry contains a concrete concealed payload-execution chain, not merely suspicious primitives. Lack of lifecycle hooks does not mitigate import-time arbitrary execution.

The appended Babel-config payload is unrelated to asset extraction and contains an explicit remote code-execution chain. Absence of install hooks reduces automatic-install exposure but do...

The obfuscated tooling payload has a concrete remote-code-execution chain and detached-process launch, unrelated to the declared package function. Absence of an install hook limits automa...

This is a concrete staged remote-code-execution chain, not merely a networking or evaluation primitive. Lack of an install hook limits the trigger but does not remove the malicious runtim...

The package contains a concrete remote code execution chain hidden behind its public API. The lack of lifecycle hooks limits automatic installation execution but does not mitigate the mal...

The package contains a concrete remote-code-execution chain activated by normal runtime use. Lack of an npm lifecycle hook limits installation impact but does not mitigate the malicious r...