npm remote execution reports, with evidence.

The direct external script tag is an immediate, unpinned remote payload loader, not merely an inert library reference. Combined with automatic service-worker proxy setup and pervasive obf...

This is not a benign library artifact: the package auto-executes third-party remote code and installs a browser request-routing proxy to unrelated infrastructure. No install hook is neede...

This is not an install-hook compromise, but it is a deliberately obfuscated static package whose primary entrypoint immediately delegates code execution to an unrelated remote host and co...

Direct source inspection confirms automatic remote-code execution and local obfuscated dynamic execution when the declared HTML entrypoint is opened. Absence of npm lifecycle hooks does n...

Source inspection confirms executable remote code loading and a persistent browser request-interception proxy tied to unrelated hosts. This is concrete harmful behavior despite the absenc...

Although installation itself has no lifecycle execution, the shipped browser entrypoint contains a concrete remote-code and request-interception chain. This exceeds a benign static-site p...

Direct source and published-entrypoint inspection confirms an import-triggered, encrypted staged payload executed by a detached Node subprocess. No lifecycle hook is needed for this concr...

This is not a normal executable npm library: its HTML entry silently imports unrelated remote code and establishes browser interception/proxy infrastructure. The absence of install hooks...

Direct source inspection confirms automatic third-party remote code execution and an obfuscated proxy relay chain. Although npm installation alone has no lifecycle execution, the shipped...

The remote script tag is source-confirmed and automatically executes code controlled outside the package. Obfuscation and bundled browser interception support make this an unsafe staged r...

The package contains a concrete remote-code-execution chain, not merely network or process primitives. Absence of an install hook limits the trigger but does not mitigate runtime executio...

This is a concrete import-time remote-code-execution chain, not merely suspicious primitives. The hidden endpoint and token obfuscation, detached execution, and unrelated exported functio...

This is a concrete remote-code-execution chain unrelated to the declared package purpose. It is runtime-triggered rather than lifecycle-triggered, but remains malicious.

The unconditional remote script is sufficient concrete remote-code execution behavior at browser runtime; its behavior is not pinned or package-contained. Absence of lifecycle hooks reduc...

Direct source inspection confirms automatic remote code execution and service-worker proxy persistence when the package entrypoint is opened. These behaviors are unrelated to the package...

No install hook executes during npm installation, but the declared browser entrypoint contains a concrete third-party remote-code execution path and an opaque request-interception stack....

This is not merely a scanner signal: the manifest points to `index.html`, which directly executes an arbitrary remote script. The remote execution is sufficient for a blocking malicious v...

This is not an inert library artifact: its entrypoint executes remote, operator-controlled code and includes browser request-interception infrastructure. Absence of npm lifecycle hooks do...

The unconditional remote executable script is a concrete externally controlled payload channel, and the bundled service-worker proxy infrastructure expands its browser-side interception c...

This is not an npm lifecycle attack, but the primary package artifact unconditionally executes a remote script from an unrelated host. The obfuscated browser bundle and request-proxy comp...

The package contains a concrete remote-code loader and automatic persistent browser traffic-routing mechanism unrelated to its declared package identity. Although it has no npm install ho...