npm remote execution reports, with evidence.

Source inspection confirms a concrete, obfuscated runtime dependency-install and execution chain triggered by normal documented APIs. Lack of an npm lifecycle hook limits the trigger but...

Static inspection resolves the prior manual review: despite package-aligned media rendering code and no install hook, the bundle contains a reachable external JavaScript loader whose fixe...

Source inspection confirms a concrete remote payload fetch-and-execute chain, independent of scanner labels. The lack of install hooks does not mitigate runtime arbitrary code execution i...

This is a concrete remote code execution backdoor, not required for SVG retrieval. Absence of install hooks limits automatic activation but does not remove the malicious exported capability.

Source inspection confirms concrete import-time remote payload delivery and execution, not merely suspicious primitives. The lack of an npm lifecycle hook does not mitigate execution for...

Direct inspection confirms a concrete runtime exfiltration and remote-code-execution chain, not merely suspicious primitives. Absence of install hooks limits the trigger to middleware inv...

`index.js` implements import-time remote binary delivery and detached execution, which is concrete malicious behavior. The lack of an npm lifecycle hook does not mitigate execution when t...

The package has no install hook, but its ordinary runtime API launches a detached downloader that evaluates server-controlled code. This is concrete malicious behavior, not a benign use o...

Although npm installation itself has no lifecycle hook, the declared `index.html` entrypoint immediately imports remote code and ships a service-worker proxy to an external transport. The...

This is a browser application disguised as an npm package, with automatic remote script execution and proxy service-worker setup. Although no install hook or host-side harvesting was foun...

No npm lifecycle execution exists, but the declared HTML entrypoint contains concrete runtime remote-code loading and a traffic-intercepting proxy tunnel. The package's generic republish...

The manifest has no install hook, but the shipped HTML entry concretely executes an external mutable script and initializes request-intercepting proxy infrastructure at runtime. This is s...

Source inspection confirms automatic remote-code loading and a persistent browser request-interception proxy. The absence of npm lifecycle hooks limits install-time impact but does not re...

The remote executable dependency is a concrete attack mechanism, not merely a scanner signature; obfuscation and request-proxy machinery increase its risk. Lack of install hooks limits th...

Source inspection confirms runtime remote-code loading and browser proxy/service-worker behavior, while no install-time Node execution exists. The hidden remote loader and obfuscated cont...

Direct execution of an unpinned third-party script is a concrete remote-code-execution path in the package's runtime. The browser proxy/service-worker stack increases the impact, while ab...

No install-time execution was found, but the shipped browser entrypoint contains an immediate third-party payload load and a hard-coded remote proxy control path. Those behaviors establis...

The direct, unpinned external script import is concrete runtime attack behavior. The browser proxy and service-worker components compound the risk; absence of npm lifecycle hooks does not...

The remote executable dependency is unconditional in the package entry point, and the bundled service-worker proxy broadens its ability to handle browser traffic. Lack of npm lifecycle ex...

This is not merely obfuscated vendor code: the entry page directly delegates execution to an unrelated remote host and activates a cookie-aware proxy control plane. The absence of install...

No install-time hook runs, but the package's declared runtime entry directly executes an unrelated remote script and establishes a service-worker proxy that can process browsing traffic a...