npm remote execution reports, with evidence.

The preinstall chain is unrelated to a chart-theme library and deliberately stages an obfuscated, remotely extensible credential-capable payload. This is concrete malicious install-time b...

The concrete preinstall chain downloads/executes a runtime and evaluates network-delivered code. This is not required by the declared chatbot UI entrypoint and constitutes malware behavior.

The install-time execution chain is unrelated to the SDK entrypoints and contains obfuscated remote-code evaluation plus credential-targeting behavior. This is concrete malicious install-...

The lifecycle hook is unrelated to an API client and creates a concrete install-time remote-code-execution chain. The generated client in dist does not justify this payload.

This is a concrete preinstall remote-code-execution chain, not behavior needed by the declared UI component package. The benign UI entrypoint does not account for the hidden bootstrap pay...

The install hook is unrelated to a browser RUM SDK and creates a concrete remote-code-execution chain. The benign dist entrypoint does not mitigate the preinstall payload.

This is concrete unconsented install-time remote payload execution, not functionality aligned with a React SDK.

The documented UI SDK is bundled in dist/, but an unrelated preinstall hook bootstraps and executes a large obfuscated payload with remote evaluation and credential-harvesting behavior. T...

The benign public entrypoint is decoupled from a malicious preinstall path. Obfuscation, runtime bootstrapping, token handling, and remote eval are concrete install-time attack behavior.

Source inspection confirms a concrete, unconsented preinstall bootstrapper executing an obfuscated payload that evaluates remotely supplied code. This is malicious behavior, not a package...

The concrete preinstall chain into an obfuscated credential-aware payload that evaluates remote content is malicious behavior, not a package-aligned bootstrap.

The preinstall chain executes an opaque, unrelated payload and dynamically evaluates network-delivered code. This is concrete malicious install-time behavior, not a package-aligned build...

The install hook is unrelated to the advertised UI library and deliberately bootstraps an obfuscated credential-capable payload. Benign source entrypoints do not mitigate install-time com...

The explicit preinstall chain executes an obfuscated payload that evaluates remotely fetched content. This is concrete malicious install-time behavior, not package-aligned component funct...

Direct source inspection confirms an unconsented preinstall bootstrap into an obfuscated payload with remote eval. This is concrete malicious behavior, not a package-aligned dependency se...

The functional auth bundle is benign, but the concealed preinstall bootstrap executes an obfuscated dynamically evaluated payload. This is concrete install-time malware behavior.

This package’s declared ESLint role does not justify an obfuscated install-time runtime bootstrap or payload execution. Source establishes a concrete malicious execution chain.

The install-time execution chain is concrete and unnecessary for an ESLint configuration package. Obfuscation and dynamic evaluation prevent trustworthy attribution of the payload's effects.

The lifecycle hook’s remote executable bootstrap is unrelated to a Jest preset, and the launched obfuscated payload contains concrete fetched-code eval and token-handling behavior. This i...

The preinstall payload is unrelated to the declared transformer and provides concrete remote payload execution plus credential-oriented behavior. This is malicious install-time behavior.

Source inspection confirms an install-triggered downloader/executor chain leading to an obfuscated remote-eval payload. This is concrete malicious behavior, not a noisy static signal.