npm detections from LPM Firewall.

The malicious loader is directly reachable from the declared main entrypoint without a lifecycle hook or user opt-in. Its download-and-execute chain is concrete and unrelated to the adver...

Concrete, import-triggered remote payload execution is present in _polyfill.js and is reachable from index.js. The lack of an npm lifecycle hook does not mitigate this runtime execution p...

The import-triggered, unauthenticated download-and-execute chain is concrete remote code execution behavior and unrelated to the advertised type wrapper.

The hidden import-time loader provides a complete unconsented remote-code-execution chain. Absence of npm lifecycle hooks does not mitigate runtime activation on normal package import.

This is a concrete import-time staged payload execution chain, not ordinary telemetry. The lack of lifecycle hooks does not mitigate execution when consumers import the package.

This is a concrete import-time remote-code-execution chain disguised as compatibility/telemetry behavior. Absence of an npm lifecycle script does not mitigate execution when consumers imp...

This is import-time arbitrary native code execution sourced from attacker-controlled remote infrastructure. Absence of an npm lifecycle hook does not mitigate the reachable main-entrypoin...

This is a concrete import-time remote payload execution chain, not telemetry. The absence of lifecycle hooks does not mitigate execution on normal package use.

This is concrete runtime remote-code execution, not ordinary telemetry: a minimal adapter imports a hidden loader that retrieves and launches unsigned binaries. The absence of lifecycle h...

This is a concrete import-time staged-payload execution chain, not merely telemetry. The absence of an npm lifecycle hook does not mitigate execution whenever the package is imported.

The package’s declared certificate API is unrelated to its import-time downloader/launcher. No lifecycle hook is needed because requiring the main entrypoint triggers the malicious chain.

Confirmed import-time staged payload download and detached execution is concrete malicious behavior, regardless of the absence of npm lifecycle hooks.

This is a concrete import-time remote code-execution chain, not ordinary telemetry: arbitrary remote bytes are executed without integrity verification or user invocation. The lack of inst...

This is a concrete import-time remote payload execution chain unrelated to the advertised adapter. No install hook is needed because requiring the normal entrypoint triggers it.

This is a concrete, stealthy import-time remote payload execution chain unrelated to the stated token utility. The lack of install hooks does not mitigate runtime compromise when consumer...

Source inspection confirms concrete import-time download-and-execute behavior. The absence of lifecycle hooks does not mitigate execution when consumers import the main entrypoint.

This is a concrete import-time remote-payload execution chain unrelated to the documented holder interface. No install hook is required for compromise.

This is concrete, unconsented import-time remote code execution unrelated to the advertised logging middleware. The DNS fallback and obfuscated endpoints further establish a staged malwar...

The entrypoint reaches an automatic remote native-payload execution chain; it is unrelated to the documented minimal device-integration API. Lack of an npm lifecycle hook does not mitigat...

Source establishes an import-time staged payload download and detached native execution chain; no user action beyond importing the SDK is required. The telemetry-like naming and opt-out c...

This is concrete import-time staged-payload execution unrelated to the advertised cashback API. Lack of an npm lifecycle hook does not mitigate the reachable runtime execution path.