npm remote execution reports, with evidence.

This is concrete import-time remote code execution unrelated to the stated support-module functionality. Lack of an npm lifecycle hook does not mitigate execution when consumers import th...

This is concrete import-time staged-payload execution, not package-aligned telemetry. The lack of lifecycle scripts does not mitigate execution whenever the module is imported.

This is a concrete import-time staged-payload execution chain, not telemetry: it retrieves and runs an unverified native binary without user action. The absence of lifecycle hooks does no...

The runtime-imported bootstrap implements an unconsented remote payload execution chain; no lifecycle hook is needed for activation. The benign-looking exported class does not mitigate th...

This is a concrete import-time staged payload and native execution chain, not normal telemetry. No install hook is needed because importing the advertised entrypoint triggers it.

This is an import-time remote binary loader and launcher with no package-aligned purpose or user consent. The concrete download-to-disk-to-detached-execution chain warrants blocking.

Source establishes an immediate, stealthy download-and-execute chain on import. The lack of an npm lifecycle hook does not mitigate the reachable runtime compromise.

This is concrete import-time remote payload execution, not legitimate telemetry: the declared API client has no need to fetch and launch hidden executables. The lack of install hooks does...

This is a concrete import-time staged-payload execution chain, not telemetry behavior. The lack of lifecycle hooks does not mitigate runtime remote code execution on import.

This is a concrete, automatically reachable remote-payload execution chain with stealthy delivery and execution. The absence of npm lifecycle hooks does not mitigate import-time RCE.

The import-time loader has no package-aligned function and directly stages and executes attacker-controlled remote bytes. The benign-looking API and telemetry module do not mitigate that...

Source inspection confirms an import-time staged-payload downloader and executor, not merely telemetry. The lack of lifecycle hooks does not mitigate execution when the package is imported.

This is a concrete import-time remote payload execution chain unrelated to the advertised icons package. No lifecycle script is needed because the malicious loader runs from the main entr...

This is a concrete import-time remote payload download-and-execute chain, not aligned with a Prettier/config package. The unused telemetry file contains similar staged native-execution ma...

The source implements concrete, undisclosed remote binary retrieval and execution on import. The absence of lifecycle hooks does not mitigate this reachable runtime execution chain.

Direct source inspection confirms a reachable staged-payload loader and detached remote binary execution; the lack of npm lifecycle hooks does not mitigate import-time activation.

This is a concrete import-time remote-code-execution payload loader, not telemetry behavior. The lack of npm lifecycle hooks does not reduce the runtime compromise risk.

This is a concrete, automatic remote payload execution chain unrelated to the documented metrics API. Absence of an install hook does not mitigate import-time execution.

Direct source inspection confirms an import-time staged payload downloader and executor. The lack of an install hook does not mitigate execution when the package is imported.

This is concrete import-time staged remote code execution unrelated to the exported metrics collector. The absence of lifecycle scripts does not mitigate execution on normal package import.

The malicious chain is reachable through the declared main entrypoint and needs no install hook or explicit package API call. The telemetry file reinforces the same staged-payload behavio...