npm remote execution reports, with evidence.

This is a concrete, automatic remote-payload execution chain unrelated to the declared carousel functionality. It is malicious despite having no npm lifecycle script.

The reachable import-time loader provides a concrete arbitrary remote code execution chain, not legitimate telemetry behavior. Lack of an npm lifecycle hook does not mitigate execution on...

The package's only advertised runtime API does not require telemetry, yet its entrypoint silently fetches and executes unverified remote bytes. This is a concrete import-time remote-code-...

This is concrete import-time staged payload execution, not package-aligned telemetry. The absence of lifecycle hooks does not mitigate execution whenever consumers import the package.

The package's import-time loader provides an unauthenticated remote-code-execution chain with concealed endpoints and no legitimate API linkage. This is concrete malicious behavior, indep...

This is a concrete, automatic remote-payload execution chain unrelated to the advertised minimal forms package. Lack of install hooks does not mitigate import-time execution.

Source directly establishes import-time remote payload retrieval and execution. The package description and exposed API do not justify this behavior.

The package contains a concrete, automatically reachable remote binary download-and-execute chain unrelated to its advertised carousel interface. This is malicious remote code execution,...

This is a concrete import-time staged payload execution chain, unrelated to the advertised visual-components/circuitbreaker API. Absence of an npm lifecycle script does not mitigate runti...

The documented pub/sub package has an undeclared import-time remote payload execution chain unrelated to its stated functionality. This is concrete malicious behavior, not telemetry.

The source implements concrete download-and-execute behavior on normal package import, with obfuscated endpoints and no integrity validation. The lack of npm lifecycle hooks does not miti...

The malicious chain is concrete, import-reachable, and executes unauthenticated remote bytes; the telemetry naming does not provide a legitimate package-aligned purpose.

The package’s import path contains a concrete, stealthy remote code-execution chain unrelated to its stated GitLab-label SDK purpose. This is malicious behavior, not benign telemetry.

The package implements an unverified staged payload path culminating in dynamic code execution, not merely data-driven audit rules. Lack of an install hook limits activation to explicit C...

This is a concrete install-time remote payload execution chain unrelated to the declared React drawer package. Obfuscation, fallback DNS payload delivery, hidden filenames, and suppressed...

Direct source inspection confirms a postinstall downloader/dropper/launcher chain with remote payload control. The package provides no legitimate implementation that would require executi...

Source confirms an import-triggered remote payload loader and detached execution chain. The absence of an npm lifecycle hook does not mitigate runtime compromise of package consumers.

This is a concrete import-time remote-code-execution chain unrelated to the advertised state-store functionality. The opt-out variables and telemetry README claim do not justify downloadi...

This is a concrete import-time staged-payload execution chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate execution when consumers import the package.

Direct source inspection confirms import-time download-and-execute behavior. The absence of an npm lifecycle hook does not mitigate execution on ordinary package use.

The documented telemetry claim is inconsistent with the import-time download-and-execute behavior. No lifecycle hook is needed because ordinary package import activates the payload chain.