npm remote execution reports, with evidence.

This is concrete import-time staged payload execution, not legitimate telemetry: the package advertises only foundational types and exposes no related user-invoked feature.

This is an import-time staged payload downloader and arbitrary executable launcher, unrelated to the package's exported REST-resource API. The absence of lifecycle hooks does not mitigate...

This is a concrete, concealed import-time remote-code-execution chain unrelated to the package's stated functionality. Absence of an npm lifecycle hook does not mitigate execution on norm...

The package has no install hook, but its normal import path performs concealed download-and-execute behavior. This is concrete arbitrary code execution, not package-aligned Sentry telemetry.

This is a concrete, import-time remote payload execution chain unrelated to the stated component SDK. Absence of an npm lifecycle hook does not mitigate execution when consumers import th...

This is a concrete import-time remote payload execution chain, not ordinary telemetry. No lifecycle hook is needed because the main entrypoint triggers it.

The import-time downloader-to-detached-native-execution chain is concrete and unrelated to the declared component package. No install hook is needed because importing the package triggers...

This is a concrete import-time staged-payload execution chain unrelated to the advertised SDK, with no integrity validation or explicit user action.

The main entrypoint activates a concrete download-and-execute path without user action or a legitimate package feature. Absence of lifecycle hooks does not mitigate import-time native cod...

The behavior is import-time, concealed, and executes attacker-controlled remote bytes without user action. Lack of npm lifecycle hooks does not mitigate the reachable loader.

This is a concrete, automatically triggered remote payload execution chain unrelated to the package's stated minimal library API. Opt-out environment checks do not establish informed user...

This is a concrete, import-triggered remote payload execution chain unrelated to the package’s stated interface. The same staged native-profiler pattern also appears in lib/telemetry.js.

This is concrete, unconsented import-time remote payload execution unrelated to the advertised UI-avatar package. The scanner path for telemetry was noisy, but direct inspection confirms...

This is concrete import-time remote code execution, not legitimate telemetry: arbitrary downloaded bytes are executed without user action or verification.

The package's import-time bootstrap is a concrete remote-code-execution chain unrelated to its declared React button functionality. Lack of an npm lifecycle hook does not mitigate executi...

This is a concrete import-time staged-payload chain, not ordinary telemetry. The package's advertised chart API does not require or expose this behavior.

The import-time downloader and detached execution are concrete malicious behavior, not telemetry. The unused telemetry implementation contains the same native-payload pattern and reinforc...

The import-time downloader-to-execution chain is concrete and unconditional apart from opt-out/short-lived stamp checks. No lifecycle script is needed because the malicious code executes...

This is concrete import-time staged payload execution unrelated to the declared React-components package purpose. The unused telemetry module does not mitigate the directly reachable loader.

Direct source inspection confirms a concealed, import-time remote payload execution chain. The absence of lifecycle hooks does not mitigate runtime compromise when consumers import the pa...

The package contains a concrete, import-time remote-code-execution chain with stealthy second-stage retrieval and detached execution. The legitimate payment SDK source does not account fo...