npm remote execution reports, with evidence.

The inspected entrypoint directly downloads and executes a reverse-shell payload. This concrete attack behavior supports blocking despite the absence of an install hook.

Inspected source establishes automatic concealed remote executable download and execution, unrelated to environment configuration. This is an active attack, rather than an inert payload c...

Automatic execution of a hidden encoded PowerShell payload from a JPEG is concrete malicious behavior. Block publication.

This is an active concealed remote-code-execution chain, not environment configuration functionality. The import-time and CLI triggers make the payload directly reachable.

The import-time daemon and remote Function execution form an active remote-code-execution path. The cryptographic check authenticates the operator payload rather than constraining its cap...

The package contains an import-triggered, detached remote payload loader that executes server-authorized JavaScript. This is concrete remote code execution, not ordinary item validation.

The package contains and automatically activates a hidden encoded-PowerShell launcher from both its library and CLI entrypoints. This is concrete malicious execution behavior unrelated to...

Importing the package runs an obfuscated loader that shells out through execSync and prepares host and username collection plus an axios send. That is concrete remote command execution hi...

The published main module immediately runs an obfuscated payload that loads shell execution, filesystem access, and an HTTP client. That is hidden import-time attack behavior, not a logge...

The published plugin entries hide a fetch of option-derived content and execute it with Node require during ordinary cryptoPlugin setup. That is remote code execution, separate from the l...

The package embeds a concealed, configuration-derived remote code execution path in its runtime entrypoints. This is concrete attack behavior beyond the declared encryption feature.

The published node is fully obfuscated and, on import, runs a concealed Go WebAssembly payload after exposing Node filesystem and OS APIs to it. That is hidden code execution in the host...

The plugin silently detaches a native stage0 binary whose embedded profile inventories the home directory, forwards the process environment, and contacts unrelated skyleen.fr control serv...

Load-time execution in the main and CLI bundles extracts a concealed command from a bundled JPEG and runs it through hidden PowerShell, which is a concrete remote-code dropper. The readab...

The package ships a hardcoded curl-to-shell remote execution path and a caller that invokes it, including a CI job that updates from a local registry first. There is no install lifecycle...

This is concrete import-time environment exfiltration followed by remotely supplied code execution. The lack of an install hook does not reduce the risk to consumers that load the package.

This is concrete concealed code execution, not environment configuration behavior. The automatic entrypoint calls and hidden encoded PowerShell launcher warrant blocking publication.

The reachable encrypted decrypt-and-require chain is a concrete hidden code-execution mechanism. Absence of an install hook does not remove the runtime execution risk.

Source is a fake Cloudflare challenge whose obfuscated script fetches, AES-CTR decrypts, and Function-executes a remote payload, then redirects the visitor. That is a concrete browser rem...

Source shows a random-named HTML dropper that impersonates Cloudflare, contacts a reconstructed API, decrypts the reply, and executes it with Function. That is a concrete browser remote-c...

Source shows a fake Cloudflare interstitial whose obfuscated script fetches, decrypts, and Function-executes a remote payload. Missing install hooks only means npm will not auto-open the...