npm remote execution reports, with evidence.

The package contains concrete, obfuscated import-time payload delivery and execution behavior unrelated to its stated Tailwind functionality. Absence of lifecycle hooks does not mitigate...

This is concrete import-time remote code execution unrelated to Tailwind animation functionality. Absence of lifecycle hooks does not mitigate activation during normal plugin loading.

This is a concrete import-time staged-payload execution chain unrelated to the advertised contacts wrapper. The lack of lifecycle scripts does not mitigate execution on ordinary package i...

This is a concrete, automatically triggered remote payload download-and-execute chain unrelated to the declared API-client functionality. The lack of lifecycle hooks does not mitigate the...

The malicious chain is import-reachable and independently confirmed in source. The lack of lifecycle hooks does not mitigate automatic runtime execution.

This is a concrete import-time remote payload execution chain unrelated to the declared popup module. Lack of lifecycle hooks does not mitigate execution through the package entrypoint.

This is concrete import-time staged remote code execution, unrelated to the documented adapter API. No install hook is needed because ordinary package use triggers it.

This is concrete import-time remote payload execution, not legitimate telemetry behavior. The larger telemetry module duplicates the same downloader/launcher design.

This is an import-time, unsigned remote native-payload execution chain unrelated to the documented error-module API. The lack of lifecycle hooks does not mitigate the reachable runtime RCE.

This is concrete import-time staged payload execution, not package-aligned configuration behavior. Lack of an npm lifecycle hook does not mitigate execution on normal require/import.

This is a concrete import-time remote-code-execution chain unrelated to the stated identity-client function. Absence of an install hook does not mitigate execution when consumers import t...

The package's declared interface is a small inert class, but its import-time support module implements a concealed remote payload execution chain. This is concrete malware behavior, not p...

This is a concrete, import-time remote native payload execution chain, not telemetry. The absence of lifecycle hooks does not mitigate execution on normal package import.

This is a concrete, hidden remote payload execution chain triggered by a normal import, unrelated to the package’s minimal advertised wrapper API. The lack of an install hook does not mit...

The advertised clipboard SDK has no legitimate need to silently retrieve and execute unverified native payloads at import time. This is concrete remote code execution, independent of the...

Confirmed source establishes a concrete, silent remote-payload execution chain reachable from the package entrypoint. The lack of install hooks does not mitigate runtime compromise on imp...

The package contains concrete import-time download-and-execute behavior, not merely telemetry primitives. The lack of install hooks does not mitigate execution when a consumer imports the...

This is confirmed import-time remote payload execution, not legitimate telemetry. The lack of an npm lifecycle hook does not mitigate execution when consumers import the package.

This is a concrete, import-time remote-code-execution chain with opaque payload delivery and stealth-oriented error suppression. The lack of an npm lifecycle hook does not mitigate runtim...

The package's public entrypoint automatically performs an unauthenticated remote payload retrieval and execution chain. No user action beyond importing the package is required.

This is concrete import-time remote code execution, not ordinary telemetry: fetched opaque bytes are executed without validation. The similar profiler loader in lib/telemetry.js reinforce...