npm remote execution reports, with evidence.

Source inspection confirms an unverified, environment-configurable payload loader executed during postinstall. The shipped public module does not implement the README's TWAP functionality...

The advertised library code is benign, but its postinstall hook silently stages and executes server-controlled code. This is a concrete malicious supply-chain execution chain.

The main entrypoint performs unconditional remote payload retrieval and dynamic execution. This is a concrete remote-code-execution chain, not a benign network use.

Source inspection confirms an import-time detached payload launcher and an obfuscated remote dynamic-code loader. The absence of lifecycle hooks does not mitigate runtime compromise on im...

The runtime-reachable, obfuscated blockchain-resolved loader executes attacker-supplied code and spawns a detached process. The benign postinstall hook does not mitigate this independent...

The install-time reverse shell is concrete, automatic remote command execution unrelated to date formatting. The package is malicious even though its auxiliary collection file is not invo...

The manifest directly defines an unconsented install-time reverse shell to a fixed external IP. The unused bundled reconnaissance/exfiltration script corroborates the malicious purpose.

Confirmed source contains a staged remote-code-execution loader, despite no npm install hook. The deferred trigger does not reduce the concrete malicious behavior.

Source inspection confirms concrete staged remote execution and detached process launch, not merely suspicious primitives. Absence of lifecycle hooks does not mitigate import-time execution.

Source establishes an automatic remote-payload-to-execution chain with no user invocation or integrity verification. This is concrete malware behavior, not ordinary telemetry.

This is concrete import-time staged payload execution, not normal telemetry: opaque remote binaries are fetched, dropped, and executed without user action. The same behavior is also imple...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. No lifecycle hook is needed because index.js reaches the loader whenever consumers import the package.

This is a concrete, import-triggered remote code execution chain with concealed payload delivery and detached execution. The absence of npm lifecycle scripts does not mitigate the runtime...

The import-time bridge is a concrete staged malware loader, independent of npm lifecycle scripts. The telemetry module also implements a similar configurable native-extension loader.

The import-time remote download-and-execute chain is concrete source behavior, not a scanner-only inference. It is unrelated to the package's stated TypeScript-definition purpose.

Source directly confirms an automatic staged payload downloader and executor at the package entrypoint. The lack of install hooks does not mitigate runtime import-time execution.

This is a concrete import-time remote native payload execution chain, not normal telemetry. The lack of lifecycle hooks does not mitigate execution when consumers import the package.

This is a concrete import-time remote-code-execution chain with no integrity verification and concealment through fragmented strings, rotating hosts, temporary filenames, and suppressed e...

This is a concrete, import-triggered remote payload execution chain with obfuscated endpoints and no payload validation. It is unrelated to the declared API-client purpose.

The source provides a concrete, automatically reachable remote payload download-and-execute chain, not merely telemetry behavior. Lack of an install hook does not mitigate execution on no...

This is concrete, automatically reachable remote native-code execution, not telemetry functionality. Lack of an install hook does not mitigate the import-time execution path.