npm remote execution reports, with evidence.

The benign exported module does not justify a preinstall downloader that executes an obfuscated payload with remote eval and GitHub-token handling. These behaviors establish a concrete ma...

The preinstall hook deliberately bootstraps and executes an unrelated obfuscated payload, including remote code evaluation and credential-related logic. This is concrete malicious install...

This is a concrete remote code-execution primitive, despite being gated behind an explicitly enabled debug plugin. No install-time behavior was found.

Automatic execution of an unverified, remotely supplied shell payload is a concrete install-time remote-code-execution chain. Runtime API and media-tool execution do not mitigate that ins...

The import-time, unauthenticated remote-binary execution chain is concrete and unrelated to a settings/config package. The unused-looking telemetry module duplicates the same downloader/e...

This is a concrete import-time remote code execution chain with stealthy payload delivery and execution. It is not required for the documented library API.

The package contains a concrete remote-code-execution chain, not merely service-worker registration logic. The fetched script is executed in Node via eval with no origin or integrity vali...

This is concrete import-time remote payload execution, not package-aligned telemetry. The absence of lifecycle hooks does not mitigate execution during normal use.

The package contains a reachable import-time downloader/executor, not just telemetry primitives. The absence of install hooks does not mitigate execution on normal use.

Source inspection confirms an import-triggered remote binary download and execution chain in _bridge.js. No lifecycle hook is needed because index.js invokes it at runtime.

The import-time loader implements concrete, unauthenticated remote binary execution. This is malicious behavior independent of the lack of npm lifecycle hooks.

This is a concrete import-time remote code execution chain, not ordinary telemetry: remote binary bytes are executed without authentication. The absence of an npm lifecycle hook does not...

The package contains concrete, reachable remote payload execution on import. The absence of an install hook does not mitigate this runtime compromise.

This is a concrete import-time remote-code-execution chain unrelated to the minimal exported SDK. The absence of npm lifecycle hooks does not mitigate runtime execution on ordinary use.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The missing install hook does not mitigate execution when consumers import the package.

This package contains an import-time, unsigned remote binary loader and detached executor unrelated to its minimal stated client API. The concrete execution chain is sufficient for a bloc...

The package's normal import path provides an immediate, unverified download-and-execute capability. Obfuscated endpoint construction, DNS payload fallback, and detached execution establis...

This is a concrete, automatic remote-code-execution chain in the package import path. The lack of an npm lifecycle hook does not mitigate the unconsented runtime payload execution.

The package's normal import path executes a concealed downloader and launches its unverified remote response. Absence of an install hook does not mitigate the import-time RCE.

The package has a concrete import-time remote-code-execution chain, with binary retrieval, disk drop, and detached execution. The absence of lifecycle scripts does not mitigate execution...

This is a concrete, unconsented import-time remote-code-execution chain with stealthy payload delivery and execution. The absence of lifecycle hooks does not mitigate activation on ordina...