npm remote execution reports, with evidence.

This is a concrete staged remote-code-execution chain hidden as telemetry, activated automatically during installation and import. The package has no legitimate drawer implementation that...

The advertised state-store package has an undeclared, import-triggered remote native payload loader and executor. This is concrete malware behavior, not ordinary telemetry.

Source inspection confirms import-time remote payload retrieval and detached execution, not ordinary telemetry. The package should be blocked.

The package implements covert import-time remote payload staging and execution, not ordinary telemetry. The no-lifecycle manifest does not mitigate this runtime RCE path.

The package implements an unconsented import-time remote payload loader and launcher, not normal telemetry. No lifecycle hook is needed because the behavior activates whenever consumers i...

This is concrete, automatic remote code execution hidden behind purported telemetry in a React component package. The absence of an npm lifecycle hook does not mitigate import-time execut...

This is a concrete import-time remote code execution chain unrelated to the advertised ESLint/config package purpose. The absent npm lifecycle hook does not mitigate automatic execution o...

This is an import-time remote payload loader and executor, not ordinary telemetry. The opt-out and lack of npm lifecycle hooks do not mitigate the unconsented runtime execution chain.

The package has no install hook, but ordinary import causes a hidden downloader/dropper to execute an unauthenticated remote native payload. Its behavior is incompatible with the stated R...

This UI package contains a concrete remote-payload execution chain unrelated to its stated functionality. The postinstall hook suppresses errors, increasing stealth.

Direct inspection confirms a reachable obfuscated npm-install-and-execute path in index.js. The absence of install hooks limits automatic activation but does not remove the concrete runti...

The advertised SVG-fetching purpose does not justify executing arbitrary code returned by an unrelated hard-coded host. This is a concrete remote-code-execution payload path despite lacki...

The package implements a remotely controlled execution and file-management agent against an unrelated hardcoded endpoint. Although it has no install hook and requires runtime activation,...

The package's sole runtime behavior is unvalidated remote-code retrieval and eval at import time. This is a concrete remote code execution chain, not merely a suspicious primitive.

The package contains an unconsented install-time and import-time concealed arbitrary-code execution chain. The blockchain library functionality does not justify this detached decrypted pa...

The package is a minimal carrier for an unauditable remote dependency that automatically executes installation code. Static exports are benign but do not mitigate the install-time executi...

This is a concrete remote-code-execution backdoor pattern, not merely normal CLI process launching. Lack of an install hook limits automatic exposure but does not remove the dangerous rea...

This is a concrete install-time remote code execution chain, not required by the documented monitoring functionality. The benign runtime implementation does not mitigate the postinstall l...

This package has concrete import-time payload staging and execution behavior, not array utility functionality. Obfuscation and hidden execution establish a malicious remote-code-execution...

The package contains a concrete, automatic remote payload download and detached execution path on import. Its documented functionality provides no legitimate need for this behavior.

The import-time payload downloader and detached executable launch are unrelated to calendar bucketing and require no user action beyond importing the package.