npm detections from LPM Firewall.

Source establishes an import-time remote payload download-and-execute chain. The absence of an npm lifecycle hook does not mitigate the reachable runtime execution.

This is a concrete import-time staged payload delivery and execution chain, unrelated to the declared infrastructure-utilities package purpose. Absence of an install hook does not mitigat...

The package implements an import-triggered remote payload execution chain with stealthy temporary files, detached processes, and fallback infrastructure. This is concrete malicious behavi...

The entrypoint creates an import-time remote binary downloader and detached executor; this is concrete malware behavior despite no install lifecycle hook.

Source inspection confirms a reachable, automatic downloader-and-executor with no user opt-in. The lack of an npm lifecycle hook does not mitigate execution when consumers import the pack...

The concrete import-time staged payload chain is independently confirmed in source. Absence of an npm lifecycle hook does not mitigate execution on normal package use.

The behavior is concrete and automatically triggered by npm postinstall, not merely an explicit setup command. It persists a downloaded MCP capability across multiple foreign AI clients.

Source inspection confirms a disguised challenge page whose callback performs an obfuscated external redirect with query forwarding. Although it has no install hook, this is concrete mali...

Direct inspection confirms a concrete, obfuscated query-parameter exfiltration and redirect chain in the only shipped entrypoint. The absence of npm lifecycle hooks does not remove the ma...

The package contains a concrete remote-payload execution chain, not merely a dynamic-evaluation primitive. Although it is user-invoked rather than install-time, the hard-coded external lo...

OpenSSF/OSV malware advisory MAL-2026-13563 blocks this version. On require() of dolyame-ui-controlgroup, _compat.js selects a per-OS/arch URL and downloads a native binary from string-sp...

The package performs concealed remote payload retrieval and execution during ordinary import, without a user-invoked setup action. This is concrete malware behavior despite the absence of...

The package contains concrete import-time, unverified remote binary execution rather than telemetry-only behavior. The lack of install hooks does not reduce the runtime RCE risk.

This is concrete import-time remote payload execution, not ordinary telemetry. No install hook is needed because requiring the advertised package entrypoint triggers the behavior.

This is a concrete import-time remote payload execution chain, unrelated to the stated data-transformation purpose. The absence of lifecycle scripts does not mitigate execution on normal...

This is a concrete, automatically triggered remote payload execution chain unrelated to the declared UI-helper package purpose. No install hook is needed because the malicious behavior ex...

The import-time downloader and detached execution chain is concrete and does not require a lifecycle hook. The telemetry naming and opt-out variables do not mitigate arbitrary remote bina...

This is a concrete import-time remote native payload execution chain unrelated to a click-outside HOC package. The lack of an install hook does not mitigate execution when consumers impor...

The import-time downloader/executor is concrete malicious behavior, not normal telemetry. Absence of npm lifecycle hooks does not mitigate runtime execution on import.

This is concrete, silent remote code execution on package import, unrelated to the stated data-transformation purpose. The absence of an install hook does not mitigate the import-time exe...

The package contains an import-time remote binary downloader and launcher disguised as telemetry. The lack of install hooks does not mitigate runtime arbitrary code execution on import.