npm remote execution reports, with evidence.

The behavior is explicit rather than stealthy, but it is still an unconsented postinstall remote-code bootstrap with broad host mutation and no content pinning or verification. This meets...

This is concrete import-time remote code execution, not package-aligned telemetry: opaque binaries are remotely staged and launched without validation. The absence of lifecycle hooks does...

This is concrete import-time staged payload execution with no legitimate relationship to the declared datetime library. Lack of lifecycle hooks does not reduce the direct require-time exe...

The package has a normal-looking PostCSS facade, but its import-time appended payload is an explicit remote loader and executor. The behavior is unrelated to the declared CSS transformati...

Concrete import-time download-and-execute behavior establishes malware, independent of the scanner label. The lack of lifecycle hooks does not mitigate execution when consumers load the p...

The behavior is reachable during ordinary package import and executes an unauthenticated remote binary without user action. The telemetry naming and opt-out variables do not mitigate the...

The payload chain is reachable from the declared main entrypoint and enables arbitrary remote code execution without user action. Absence of lifecycle scripts does not mitigate import-tim...

The declared entrypoint causes concrete remote-payload execution without a user-invoked setup action. The benign metrics export does not justify this hidden import-time binary launcher.

This is a concrete, import-triggered remote payload download-and-execute chain unrelated to the stated chat-message interface. Absence of npm lifecycle hooks does not mitigate runtime RCE.

This is a concrete, reachable remote payload execution chain, not ordinary telemetry. Lack of an npm lifecycle hook only limits the trigger to package import.

This is a concrete import-time staged-payload and remote-execution chain unrelated to the declared UI toolkit. The absence of lifecycle hooks does not mitigate execution through the norma...

This is a concrete import-time remote-code-execution chain unrelated to the declared config SDK functionality. The lack of npm lifecycle hooks does not mitigate runtime import execution.

The malicious loader is reachable at import time and executes unverified remote bytes. No lifecycle hook is required for the attack to affect package consumers.

This is a concrete import-time remote payload execution chain unrelated to the exported metrics collector. The absent npm lifecycle hook does not mitigate execution on normal package import.

The package has a concrete import-time download-and-execute chain with obfuscated endpoint construction and DNS fallback. This is remote code execution, not package-aligned telemetry.

This is a concrete import-time staged payload loader and remote code execution chain, not ordinary telemetry. The unused telemetry module contains a parallel configurable loader design, r...

This is an import-time staged payload loader with covert fallback transport and detached execution; it is unrelated to the documented abstraction-layer API.

This is a concrete, import-time remote payload execution chain unrelated to the package's stated minimal API. The lack of lifecycle scripts does not mitigate execution when consumers impo...

This is concrete import-time remote payload execution, not normal telemetry. No installation hook is needed because any consumer runtime import triggers it.

The package's declared EventBus/test-fixture purpose does not justify an import-time remote binary loader. The concrete download-and-execute chain establishes malicious behavior.

Source inspection confirms an import-time downloader and detached payload launcher, not just suspicious primitives. The absence of lifecycle hooks does not mitigate execution on normal im...