npm remote execution reports, with evidence.

This is an import-time remote payload execution chain with obfuscated endpoints, DNS fallback, and no integrity verification. The absence of lifecycle hooks does not mitigate execution on...

This is a concrete import-triggered remote-code-execution chain, not legitimate telemetry behavior. No lifecycle hook is needed because normal dependency import activates it.

This is confirmed import-time staged-payload execution, not normal telemetry behavior. The absence of an npm lifecycle hook does not mitigate the runtime RCE path.

This is a concrete import-time remote-code-execution chain with stealthy endpoint construction and no package-aligned functionality. No install hook is needed because normal package impor...

This is concrete import-time remote code execution unrelated to the package's documented minimal API. Absence of lifecycle scripts does not mitigate execution on normal import.

This is a concrete import-time staged-payload execution chain unrelated to the package's advertised interface. The lack of install hooks does not mitigate execution when consumers import...

This is an import-time, unconsented remote binary loader and executor, not package-aligned documentation functionality. The lack of lifecycle scripts does not mitigate the reachable runti...

This is a concrete, import-triggered remote payload execution chain with stealth-oriented temporary paths and detached execution. The absent npm lifecycle hook does not mitigate execution...

The concealed payload executes automatically on import and contains both network logic and dynamic detached child-process execution. This is concrete malicious behavior, not a package-ali...

The hidden import-time loader, blockchain-based C2 discovery, and remote second-stage execution are concrete malicious behavior unrelated to the package function. No lifecycle hook is req...

Although activation is user-invoked rather than install-time, the package conceals a remote shell behind a health-client interface. The concrete command-and-control behavior warrants bloc...

The package contains a concrete remote-code-execution chain, not merely a service-worker registration helper. Absence of install hooks does not mitigate execution when the plugin is used.

Direct source inspection confirms an externally controlled payload is dynamically executed. The lack of install hooks does not mitigate runtime remote code execution.

This is concrete remote code execution and command-output exfiltration functionality, concealed by a large decoded eval payload. The lack of lifecycle hooks limits automatic activation bu...

This is a concrete install-time remote-code-execution chain unrelated to the package’s small local exports and claimed RTDS functionality.

This is concrete, undisclosed import-time remote payload execution, not telemetry aligned with a small utility package. The absence of lifecycle scripts does not mitigate the reachable ma...

The import-time bridge provides a concrete, stealthy remote code-execution chain unrelated to the advertised SDK. The absence of lifecycle hooks does not mitigate execution during normal...

The declared entrypoint performs concrete, automatic remote payload execution at import time. No install hook is needed for this to be a malicious RCE chain.

Direct source inspection confirms a concealed postinstall remote payload loader and arbitrary dynamic execution. This is concrete malicious install-time behavior.

This is a concrete install-time remote-code-execution chain, not required package functionality. Detached execution and obfuscation make the behavior covert.

The import-time remote payload execution chain is explicit in source and requires no user setup action. The unused-looking telemetry module does not mitigate this behavior.