npm remote execution reports, with evidence.

Direct source inspection confirms a deceptive package-aligned facade with runtime remote code execution from an attacker-controlled endpoint. Lack of lifecycle hooks reduces install-time...

Source inspection confirms server-controlled remote code execution from a non-package-aligned host in a package that misrepresents its purpose. The lack of install-time execution lowers a...

Source inspection confirms import-time detached execution and network-loaded JavaScript execution unrelated to a Chai assertion plugin. The benign assertion API does not explain or justif...

Source inspection confirms a concrete remote code execution loader unrelated to the advertised package purpose. Absence of install hooks lowers automatic execution risk, but user-invoked...

Static source inspection confirms an attacker-controlled remote payload loader and executor reachable at runtime. Lack of install hooks lowers automatic install-time impact, but does not...

Source inspection confirms concrete malicious behavior: hidden detached execution of remotely fetched code unrelated to a React/DOM package or normal logger middleware. Lack of install ho...

Static source inspection confirms a hidden remote payload loader that executes server-supplied JavaScript with Node capabilities. Absence of install hooks only limits the trigger; it does...

Direct source inspection confirms a non-package-aligned remote fetch plus eval path in the CommonJS entrypoint, while benign SVG utilities do not justify this behavior. The package should...

Source inspection confirms concrete unconsented install-time remote code execution via a remote bundle and npm install/require chain. The behavior is not necessary for the advertised Kell...

Direct source inspection confirms unconsented install-time remote code execution with hardcoded external payload URLs, which is concrete malicious behavior. The benign date helper entrypo...

This is concrete malicious behavior: concealed import-time network retrieval, executable drop, and process launch unrelated to the package's declared multer functionality. The absence of...

Direct source inspection confirms an install-time detached remote-code loader with obfuscation and dynamic Function execution. This is concrete malicious behavior, not package-aligned Nod...

Source inspection confirms active runtime remote code execution via fetch plus eval in assets/js/leaderboard.js, reachable from leaderboard.html. The absence of install hooks lowers npm-i...

Static inspection confirms a live remote-code execution path via fetch plus eval, not just a scanner label. Although there is no install-time behavior, the package delegates runtime code...

Direct source inspection confirms non-package-aligned network retrieval and dynamic execution in src/index.cjs, while the package claims zero-dependency SVG utilities. The behavior is not...

Source inspection confirms a reachable exported function in index.js fetches remote content and evals it, which is not package-aligned for a zero-dependency SVG helper. Although there is...

Direct source inspection confirms a remote fetch-and-eval path in a browser entrypoint, which is concrete remote code execution rather than a static data fetch. The Supabase usage appears...

Direct source inspection confirms unpinned install-time download and execution of a mutable HTTP payload outside the npm package. That is concrete remote code execution behavior rather th...

Direct source inspection confirms import-time network retrieval and dynamic execution of remote response content. The behavior is unrelated to JWT decoding and creates concrete remote cod...

Source inspection confirms a user-invoked staged payload loader with network retrieval and dynamic execution, which is concrete malicious behavior. The absence of install hooks lowers tri...

Static source inspection confirms a concealed, package-misaligned remote code execution path in index.js. Absence of lifecycle execution lowers trigger breadth but does not make the expos...