Malicious packages, on record.

The package implements an immediate remote-payload loader and dynamic evaluator with no integrity check, user action, or package-aligned functionality. This is concrete remote code execut...

The package contains an unconsented install-time remote code-execution chain. Its runtime safeguards do not mitigate this lifecycle behavior.

The package performs unconsented install-time remote payload execution and writes remotely acquired agent skills. This is a concrete supply-chain execution surface, not merely a user-invo...

The package has a concrete, default postinstall remote-payload execution chain and stages unpinned externally fetched skills for activation. Opt-in protection for shared-path migration do...

The postinstall hook executes a remotely supplied shell script whose archive and checksum share the same mutable trust source. This is a concrete install-time remote-code-execution chain,...

This is a concrete remote-code-execution loader disguised as a Tailwind plugin. Absence of an install hook limits the trigger but does not mitigate execution when the exported plugin is u...

The import-time updater silently installs a mismatched remote package into the caller's project. This is concrete unconsented remote code execution behavior, not a normal user-invoked upd...

The payload executes on package import and has a concrete network-to-eval-to-detached-process chain. The absence of lifecycle hooks does not mitigate import-time arbitrary code execution.

Direct source inspection confirms an unconsented install-time reverse shell with a hard-coded command-and-control endpoint. The benign date formatter does not justify this behavior.

The package deliberately hides an auto-running browser loader that remotely retrieves and evaluates code. Its lack of an install hook reduces install-time scope but does not remove the co...

The source implements an obfuscated remote-code loader with automatic browser activation. Absence of lifecycle hooks limits install-time impact but does not remove the concrete runtime RC...

The package contains a concealed remote code loader whose downloaded response is directly executed. Although it has no install hook, this is a concrete arbitrary-code execution surface fo...

The appended import-time payload is unrelated to a Tailwind forms plugin and contains concrete obfuscated staging, eval, and detached process execution. The lack of lifecycle hooks does n...

The package contains a concrete remote-code-execution chain, albeit behind an explicit command rather than install-time execution. This is maliciously unsafe distribution behavior because...

This is concrete malicious runtime behavior unrelated to mutex functionality, including host reporting and remote code execution. Absence of lifecycle hooks does not mitigate the callable...

Direct source inspection confirms an automatically triggered reverse shell with a hard-coded endpoint and no package-aligned purpose. This is concrete install-time remote code execution.

Direct source inspection confirms an automatically triggered reverse shell with multiple fallbacks, unrelated to the advertised date formatter.

This is concrete, unconsented install-time remote command execution, not functionality required by a date formatter. The benign exported helper does not mitigate the malicious lifecycle p...

This package contains an automatic install-time telemetry and encrypted remote-payload execution chain. Its benign runtime API does not justify that behavior.

The package contains concrete obfuscated, runtime network-to-eval-and-spawn behavior unrelated to its declared PostCSS purpose. No lifecycle hook is needed because the payload executes wh...