npm remote execution reports, with evidence.

The package exposes an unauthenticated cross-extension path to force a local AI coding agent into unrestricted execution. Local-only binding and package-owned native-host registration do...

This is concrete install-time remote code execution, not merely a dynamic-evaluation primitive. Block publication.

Direct source inspection confirms an install-time remote-code-execution chain. The remote payload is dynamically evaluated and is not constrained to a package-aligned static asset.

The package's import-time side effect is unrelated to its advertised assertion API and silently installs and executes another package with remote configuration. This is a concrete malicio...

This is concrete, unconsented import-time execution that globally installs and runs an unrelated package with an external endpoint. Absence of an npm lifecycle hook does not mitigate the...

The distributed main entrypoint contains an obfuscated, import-triggered remote payload loader unrelated to the package’s stated functionality. Absence of lifecycle hooks does not mitigat...

The package is an active remote-payload installer with concealed persistence and foreign AI-tool configuration mutation. Although it lacks npm lifecycle hooks, these concrete behaviors wa...

Concrete import-time staged payload execution is present, even though no install hook exists. The dynamic HTTP transport is not needed for the verdict.

This is concrete install-time persistence combined with network-reachable arbitrary command execution and remote script execution. It exceeds a package-aligned local relay because these h...

The lifecycle-triggered installer creates persistence and starts a LAN-exposed bridge whose local/exec handler runs supplied commands without authorization. This is concrete attack behavi...

The package performs concrete install-time persistence and exposes arbitrary command execution over a 0.0.0.0 WebSocket listener without source-visible authentication. Its platform/global...

The install hook itself is limited, but the user-invoked runtime contains an unchecked remote executable download-and-execution chain. This is concrete remote payload execution, not merel...

Direct inspection confirms a concealed staged-payload loader with eval and detached process execution in the ESM runtime path. Absence of lifecycle hooks does not mitigate this applicatio...

The package contains a concrete, obfuscated import-time remote payload execution chain. Lack of npm lifecycle hooks does not mitigate the ESM import path.

The ESM runtime entry contains a concrete concealed payload-execution chain, not merely suspicious primitives. Lack of lifecycle hooks does not mitigate import-time arbitrary execution.

The appended Babel-config payload is unrelated to asset extraction and contains an explicit remote code-execution chain. Absence of install hooks reduces automatic-install exposure but do...

The obfuscated tooling payload has a concrete remote-code-execution chain and detached-process launch, unrelated to the declared package function. Absence of an install hook limits automa...

Although there is no install lifecycle hook, explicit CLI setup creates a concrete remote-code-execution and persistence chain and mutates a foreign AI-agent configuration surface. The so...

The automatic startup update path redirects the installed package's trust boundary to a conflicting foreign npm identity and executes the resulting updater. This is concrete unconsented r...

Source establishes both storage of WhatsApp authentication material in a shared external database and remote file replacement authority for a hardcoded non-installer identity. These are c...

Source inspection confirms a lifecycle-triggered download-and-execute chain, not merely suspicious primitives. Opt-out environment flags do not make the default unprompted behavior safe.