npm detections from LPM Firewall.

Source inspection confirms an automatic, obfuscated download-and-execute chain reachable on normal import. The lack of an install hook does not mitigate import-time arbitrary payload exec...

This is a concrete import-time remote download-and-execute chain unrelated to the stated Svelte adapter functionality. No lifecycle hook is needed because normal package use triggers it.

This is a concrete import-time remote payload download-and-execute chain unrelated to the stated declaration-generator functionality. The lack of lifecycle hooks does not mitigate executi...

This is concrete import-time staged payload execution with obfuscated endpoints and no payload verification. The absence of lifecycle hooks does not mitigate execution during ordinary pac...

The public entrypoint reaches a concealed remote binary downloader and detached launcher without user action. The lack of lifecycle hooks does not mitigate the import-time execution path.

The documented package role is a configuration loader, but its import path immediately performs covert remote native payload execution. This is concrete malware behavior, not a benign tel...

The import-time loader establishes a concrete remote-payload execution chain. The unused telemetry module contains materially similar downloader/executor logic, reinforcing intent.

The loader is reachable directly from index.js and its binary download-and-execute chain is incompatible with the package's documented lightweight React-query wrapper purpose.

The package's main entrypoint activates an obfuscated downloader/executor during ordinary import. Its fallback channels, temporary persistence marker, hidden errors, and detached executio...

This is an import-time remote payload execution chain unrelated to the tiny advertised REST-client API. Its obfuscation, DNS fallback, hidden temp staging, and detached execution establis...

This is a concrete import-time remote-code-execution chain unrelated to the advertised React hooks API. The absence of lifecycle scripts does not mitigate automatic execution when consume...

Source directly establishes an import-time remote payload download and detached execution chain. The lack of an install hook does not mitigate runtime arbitrary code execution when consum...

The package has a concrete, import-time remote-code-execution chain unrelated to its stated mobile SDK API. No install hook is needed for the payload to execute when the module is loaded.

This is a concrete import-time remote-code-execution chain unrelated to the advertised React UI components. Absence of an npm lifecycle hook does not mitigate runtime import execution.

Confirmed source behavior is an import-triggered remote binary downloader and executor, not package-aligned telemetry. The unused/parallel telemetry implementation repeats the same payloa...

The package’s documented wrapper has no legitimate need to execute opaque remote binaries on import. The behavior is concrete, automatic, stealthy, and provides remote code execution.

The package contains a concrete, stealthy import-time downloader and executor of remote native payloads. The absence of an npm lifecycle hook does not mitigate runtime compromise when con...

This is a concrete import-time remote-code-execution chain unrelated to the advertised UI package. The absence of lifecycle hooks does not mitigate execution when consumers import the pac...

This is a concrete import-time remote-code-execution chain unrelated to the advertised visual-component package. Absence of lifecycle hooks does not mitigate the automatic runtime trigger.

This package contains a reachable, import-time remote payload download-and-execute chain. No install hook is needed for the behavior to affect any application that imports it.

This is an import-time staged remote-code-execution chain unrelated to the advertised UI loader, with concealed endpoints and no payload verification.