npm remote execution reports, with evidence.

This is a concrete remote-code-execution loader, not a package-aligned API implementation. Lack of an install hook limits automatic activation but does not remove the malicious runtime be...

The remote, concealed, dynamically compiled payload is a concrete remote-code-execution mechanism, not ordinary database connectivity. Lack of an install hook limits automatic activation...

The advertised utility package contains an undocumented remote code loader whose payload is controlled by a hard-coded external endpoint. Although it is not install-time execution, this i...

This is a concrete staged remote-code-execution mechanism, not a benign CDN fetch. Lack of automatic invocation reduces reachability but does not remove the malicious capability exposed b...

Source establishes a concrete remote-code-execution path when an exported API is called. Absence of lifecycle hooks reduces install-time scope but does not remove the malicious runtime ca...

The package is an explicit staged remote-code loader, not a checkout or analytics implementation. Lack of install hooks limits automatic activation but does not remove the concrete RCE ca...

The code implements a remote, server-controlled payload loader with full Node process access. Lack of automatic import or install execution limits triggering but does not remove the concr...

The concealed runtime install and execution are unrelated to SVG validation and constitute a concrete malicious execution chain. Lack of an npm lifecycle hook limits activation to explici...

This is a concrete remote-code-execution loader, not a normal resource fetcher. Lack of an install hook limits activation to runtime, but does not remove the malicious execution chain.

This is a concrete install-time fingerprinting and remote-code-execution chain unrelated to a React Native toast library. The fake integrity verification provides no meaningful protection.

This is concrete, concealed install-time download-and-execute behavior unrelated to a React table UI. The benign runtime bundle does not mitigate the preinstall RCE.

The preinstall hook contains a concrete, obfuscated remote fetch-and-eval chain. This is unconsented install-time remote code execution, not functionality required by a React UI package.

Direct source inspection confirms an install-time staged remote payload execution chain. The normal library entrypoints do not mitigate the malicious lifecycle behavior.

The concealed install-time fetch-and-eval chain is a concrete remote-code-execution mechanism, independent of the benign-looking library entrypoints. This warrants blocking publication.

Source inspection confirms an obfuscated, install-time remote payload execution chain. The normal library entrypoints do not mitigate the preinstall compromise.

The package embeds a concealed remote-code loader with disabled TLS validation, despite presenting itself as a small SVG utility. No lifecycle hook is needed for the concrete user-trigger...

The concrete postinstall download-and-execute chain, including an automatic password-dialog helper, exceeds a benign installer pattern. Fixed URLs do not mitigate the lack of integrity ve...

A hidden preinstall download-and-eval chain is concrete malicious remote-code-execution behavior unrelated to a table library. The non-executable file mode may prevent activation in this...

This is a concrete install-time remote-code-execution chain concealed with Base64 and eval. The normal library entrypoints do not justify it.

This is a concrete, unconsented preinstall remote-code-execution chain, hidden by Base64 encoding. The package should be blocked.

The package performs automatic execution of a mutable remote binary at install time, with optional same-origin checksum validation. That is a concrete install-time remote payload executio...