npm remote execution reports, with evidence.

The package contains lifecycle-triggered remote code execution by piping a live network script into bash and installing its output as the CLI binary. The CI/non-global guards reduce reach...

Source inspection confirms lifecycle-triggered remote shell execution and binary replacement without integrity checks. Even though the endpoint is package-aligned, this is a concrete inst...

Source inspection confirms lifecycle-triggered remote shell execution and binary replacement; this is a concrete install-time dangerous capability even though the endpoint is package-alig...

This is concrete install-time remote executable staging from an unauthenticated endpoint with no observed integrity verification. Although the behavior is package-aligned for a native CLI...

This package delegates its installed executable to unauthenticated install-time network content, creating a concrete remote code execution supply-chain risk even though the wrapper is CLI...

The malicious behavior is concrete and lifecycle-triggered: postinstall.js fetches unauthenticated remote content from 115.190.124.243 and executes it. The date utility files do not mitig...

Static source inspection confirms a lifecycle hook that fetches and executes remote code during installation. This is concrete malicious behavior, not merely a suspicious primitive.

Static source inspection confirms concrete import-time remote code execution with environment and host data staged in scope, hidden behind obfuscated endpoint strings. This is not package...

Direct source inspection confirms import-time remote code execution from an obscured external endpoint plus local environment and host data collection. This is not aligned with the packag...

Source inspection confirms a concrete remote-code-execution path in index.js, not merely scanner noise. Although there is no install hook, the exported API hides execution of server-suppl...

Source inspection confirms a hidden remote-code loader rather than package-aligned API functionality. Although not install-time, the exported runtime behavior is concrete malicious remote...

Source inspection confirms concrete remote code execution from an unrelated endpoint, not merely suspicious primitives or package-aligned network activity. Although there is no install ho...

This is not package-aligned Polymarket functionality; it is a remote payload loader hidden behind icon/plugin wording and documented as normal initialization. Local source confirms arbitr...

Source inspection confirms unconsented import-time background execution and remote dynamic code execution unrelated to the advertised chai assertions. This is concrete malicious behavior,...

Static inspection confirms install-time download-and-execute behavior from a remote shell script, which is a concrete unconsented lifecycle execution surface even though the endpoint is p...

Direct source inspection confirms concrete reverse-shell behavior reachable through the package export and bundled CI check script. This is not package-aligned functionality and enables u...

Direct source inspection confirms concrete reverse-shell behavior in the package main entrypoint, with check.js showing a caller path. Lack of lifecycle execution reduces automatic trigge...

Direct source inspection confirms a reachable exported function executes a remote script through bash. This is malicious remote code execution rather than a noisy scanner-only finding.

Direct source inspection confirms import-time obfuscated remote executable download and execution with a deceptive Chrome path, unrelated to multer middleware. This is concrete malware be...

Static source inspection confirms import-time remote payload retrieval and execution concealed behind a date UUID package. This is concrete, non-package-aligned remote code execution, so...

Direct source inspection confirms a deterministic install-time reverse shell in package.json. This is concrete malicious behavior independent of the package's declared Paperclip adapter f...