npm remote execution reports, with evidence.

Source inspection confirms a concrete remote-code-execution chain in package-owned runtime code, not just scanner noise. The behavior is unrelated to legitimate PWA generation and should...

Source inspection confirms an exported, README-advertised path to remote JavaScript execution via a hidden helper process. Absence of install hooks reduces automatic install-time impact b...

Source inspection confirms concrete import-time malicious behavior: obfuscated code downloads and executes a remote binary while attempting Defender exclusion and stealth/elevation. This...

This is concrete malicious install-hook behavior: unconsented postinstall download and detached execution of remote unauthenticated code. The behavior is not package-aligned with a benign...

Direct source inspection confirms covert import-time remote payload execution that is not package-aligned. This is concrete malicious behavior even without an npm lifecycle hook.

Source inspection confirms concrete runtime remote code execution unrelated to Tailwind animation functionality. The obfuscation, derived C2 URLs, eval, and detached child process executi...

The package has a concrete install-time remote payload chain that fetches, installs, and executes code from an external bundle. This is unconsented postinstall remote code execution, not...

Direct source inspection confirms import-time remote code execution from an external JSON endpoint using Function.constructor. This is concrete malicious behavior and not package-aligned...

Direct inspection confirms an obfuscated remote fetch plus eval in index.js:41 on the package's main runtime path. This is concrete malicious behavior, not a package-aligned cookie parsin...

Read-only source inspection confirms a runtime remote fetch plus eval chain in the package's main code path, using an obscured endpoint unrelated to cookie parsing. Absence of install hoo...

Source inspection confirms a concrete runtime malicious chain: an obscured remote endpoint controls code passed to eval inside the package's primary exported function. Absence of install...

Source inspection confirms a hidden network fetch and eval in index.js, unrelated to cookie parsing and activated during normal runtime use. This is concrete malicious remote code executi...

Source inspection confirms a concrete runtime RCE chain: detached child_process spawn, external payload fetch, and dynamic execution. This behavior is not package-aligned and warrants blo...

Source inspection confirms concrete import-time remote code execution from a third-party URL, with the fetched payload executed using Function.constructor and given require. This is malic...

Source inspection confirms a concrete malicious runtime chain: environment exfiltration to an obscured external endpoint followed by remote code execution. The absence of lifecycle hooks...

Source inspection confirms a non-package-aligned hidden downloader/evaluator path from index.js to lib/caller.js. This is concrete malicious runtime remote code execution, not just a nois...

Direct source inspection confirms hidden runtime network execution of server-supplied code from an unrelated endpoint. Absence of install hooks narrows the trigger but does not remove the...

Direct source inspection confirms remote payload execution from an obfuscated endpoint on runtime activation, which is concrete malicious behavior. Lack of install hooks limits trigger ti...

Static source inspection confirms concrete malicious behavior: host fingerprint exfiltration and remote code execution through a time-gated C2 loop. Absence of install hooks only narrows...

Source inspection confirms concealed runtime remote payload execution unrelated to the package's stated pack/unpack API. Even though the preinstall hook is inert, the exported function pr...

Source inspection confirms concealed runtime remote payload download and execution unrelated to the package's apparent packing utility. Even though postinstall is inert, the exported API...