npm remote execution reports, with evidence.

The package contains an automatic install-time remote payload loader that executes unaudited code from a hard-coded endpoint. This is concrete malware behavior, regardless of the benign-l...

The manifest contains a concrete, unconsented postinstall remote-code execution chain unrelated to the stated TOTP functionality. This is malicious install-time behavior.

The package contains an automatic install-time remote code execution chain that is unrelated to its advertised authentication utility. This is concrete malicious behavior and warrants blo...

The package implements direct execution of remote AI-produced commands after collecting repository status. This is a concrete unguarded remote code execution capability, not merely a stat...

The package contains a concealed import-time remote code execution payload unrelated to its advertised Tailwind functionality. No lifecycle hook is needed because normal loading of the ma...

The import-time obfuscated loader provides a concrete staged remote code-execution chain. It is not needed for the advertised Tailwind plugin behavior.

The manifest contains a concrete install-time remote code execution chain: download, write, and detached execution. This is unrelated to the declared TOTP utility and warrants blocking.

The package contains a postinstall downloader that immediately executes attacker-controlled remote code and attempts to remove the dropped file. This is concrete install-time malware beha...

The package combines unconsented install-time authentication prompting with execution of remotely generated commands and reuse of a GitHub token at a third-party model endpoint. These beh...

This package contains a concrete, user-triggered remote code execution chain hidden inside its certificate generator. The behavior is unrelated to its stated purpose and warrants blocking.

This package performs an obfuscated, unconsented install-time remote payload download and execution. The behavior is concrete malware, not a package-aligned setup step.

This is a concrete install-time persistence and C2 malware chain, not a package-aligned administrative tool. The source implements remote shell execution, surveillance, exfiltration, and...

This is concrete import-time execution of decrypted staged code from another package path, not a normal blockchain-library function. The absence of lifecycle hooks does not mitigate the e...

Published entrypoints contain an import-time staged payload launcher that decrypts externally supplied code and executes it detached. This is concrete arbitrary code execution and is unre...

The package's postinstall performs unconsented remote code execution and global agent-environment changes. Explicit opt-in protects shared-agent symlink migration, but not the default rem...

The lifecycle hook performs unconsented remote code execution through a downloaded installer. This concrete install-time execution chain warrants blocking.

The package contains import-time remote code execution through eval, which is a concrete malicious execution chain. The absence of lifecycle scripts does not mitigate runtime compromise o...

This is an import-time remote code execution loader with an intentionally obscured endpoint. It is concrete malicious behavior, regardless of the absence of lifecycle scripts.

This is a concrete install-time remote code execution chain, not a package-aligned runtime feature. The endpoint response is executed without validation.

This is a concrete install-time remote-code-execution chain, not a package feature. The mismatched README further supports deceptive intent.