npm remote execution reports, with evidence.

This is a concealed remote-code-execution loader embedded in the package's import path, with self-removal intended to hide the compromise. The lack of an npm lifecycle hook does not mitig...

The code contains an automatic remote command channel whose EVAL_CODE action directly executes attacker-supplied JavaScript. The lack of an npm lifecycle hook does not mitigate this concr...

The package contains concrete automatic credential and .env exfiltration paths and executes service-supplied shell code. The harmless postinstall banner does not mitigate these runtime be...

This is a remote-code-execution launcher: an unencrypted, server-controlled binary is automatically updated and executed without verification. Although it has no install hook, the concret...

This is concrete remote script execution and browser-data exposure, not merely a bundled model runtime. The lack of an automatic npm install hook reduces installation risk but does not ne...

The import-time hidden downloader and executable payload runner are concrete malicious behavior. The absence of an install hook does not remove the import-time execution risk.

The package embeds a live remote command channel that executes operator-provided JavaScript and returns output. No install hook is present, but the runtime behavior is concrete malicious...

The package deliberately conceals a remote code loader in its runtime entrypoint. Its network-selected payload execution is concrete malicious behavior.

The package contains a concealed import-time loader that obtains and executes remote code, then persists it as a detached process. The absence of lifecycle hooks does not mitigate this di...

Although npm installation has no lifecycle hook, the package establishes broad AI-client hooks and remotely replaces the code they execute. This is a concrete remote-code execution and pe...

The opaque curl-to-Bash execution is unrelated to calculating worktime and provides a remote party direct code execution. Its explicit-command trigger reduces exposure but does not remove...

The opaque remote-code execution is hidden behind an unrelated worktime command and gives the short-link destination arbitrary code execution. No install hook is needed for this concrete...

The package contains an active remote code loader that evaluates unverified server content. Although it has no npm lifecycle hook, this is concrete arbitrary code execution when the bundl...

This is a concrete, obfuscated remote-code loader with an explicit eval and detached process launch. Although it is not install-time, its execution through the package test path is malici...

This is a concealed remote-code-execution loader embedded in a build configuration, unrelated to page asset extraction. The absence of an install hook does not neutralize execution throug...

The package gives a remote relay direct control over shell commands and a Bash script executed on the user's machine, while uploading recorded session data. This is concrete remote code e...

The package contains a complete, obscured remote-download-and-execute chain activated by its primary API. The absence of an install hook does not mitigate this concrete runtime remote-cod...

This package contains a concealed remote code execution chain triggered by ordinary library use. The absence of an npm lifecycle hook does not mitigate the runtime download, hidden execut...

The explicit CLI setup does not make the resulting broad agent-hook persistence, remotely supplied executable updates, and cloud collection safe. The code establishes a concrete remote-co...

The package combines reviewer manipulation with automatic execution of unpinned remote code and credential handling. The lack of an npm install hook reduces scope but does not neutralize...

The package contains a concrete remote download-and-shell execution path plus silent privileged self-updating. Its install hooks are cosmetic, but runtime behavior is sufficient to block...