npm detections from LPM Firewall.

This is a concrete import-time staged-payload execution chain unrelated to the advertised SDK, with no integrity validation or explicit user action.

The main entrypoint activates a concrete download-and-execute path without user action or a legitimate package feature. Absence of lifecycle hooks does not mitigate import-time native cod...

The behavior is import-time, concealed, and executes attacker-controlled remote bytes without user action. Lack of npm lifecycle hooks does not mitigate the reachable loader.

This is an import-time remote-code-execution chain unrelated to the advertised adapter functionality. The absence of an npm lifecycle hook does not mitigate the automatic execution on nor...

This is a concrete, automatically triggered remote payload execution chain unrelated to the package's stated minimal library API. Opt-out environment checks do not establish informed user...

This is a concrete, import-triggered remote payload execution chain unrelated to the package’s stated interface. The same staged native-profiler pattern also appears in lib/telemetry.js.

This is concrete, unconsented import-time remote payload execution unrelated to the advertised UI-avatar package. The scanner path for telemetry was noisy, but direct inspection confirms...

This is concrete import-time remote code execution, not legitimate telemetry: arbitrary downloaded bytes are executed without user action or verification.

The package's import-time bootstrap is a concrete remote-code-execution chain unrelated to its declared React button functionality. Lack of an npm lifecycle hook does not mitigate executi...

This is a concrete import-time staged-payload chain, not ordinary telemetry. The package's advertised chart API does not require or expose this behavior.

The import-time downloader and detached execution are concrete malicious behavior, not telemetry. The unused telemetry implementation contains the same native-payload pattern and reinforc...

The import-time downloader-to-execution chain is concrete and unconditional apart from opt-out/short-lived stamp checks. No lifecycle script is needed because the malicious code executes...

This is concrete import-time staged payload execution unrelated to the declared React-components package purpose. The unused telemetry module does not mitigate the directly reachable loader.

The source establishes automatic collection and upload of sensitive third-party agent data, not merely a user-requested upload feature. Absence of an install hook does not mitigate the ru...

The source establishes an import-time, obfuscated telemetry and execution payload unrelated to package functionality. No lifecycle hook is needed for the payload to run when consumers loa...

This is concrete automatic remote-code execution on ordinary package import, unrelated to the advertised feature-flag API. It warrants a publish block.

Direct source inspection confirms a concealed, import-time remote payload execution chain. The absence of lifecycle hooks does not mitigate runtime compromise when consumers import the pa...

The benign JavaScript math functions are a cover for an import-time execution path that launches a bundled backdoor. No lifecycle script is needed because normal import activates the payl...

The package contains a concrete, import-time remote-code-execution chain with stealthy second-stage retrieval and detached execution. The legitimate payment SDK source does not account fo...

The import-time, obfuscated, blockchain-addressed payload retrieval and execution chain is concrete malicious behavior. Absence of an install hook does not mitigate runtime RCE on normal...

The import-time loader is concrete, stealthy remote binary execution unrelated to the stated session-management purpose. The lack of npm lifecycle hooks does not mitigate execution when c...