npm detections from LPM Firewall.

This is a concrete import-time staged-payload execution chain unrelated to the documented header library. The absence of an npm lifecycle hook does not mitigate arbitrary execution when c...

This is an import-time staged native payload execution chain unrelated to the package’s stated framework purpose. The absence of an npm lifecycle hook does not mitigate execution on norma...

This is concrete import-time remote payload staging and execution, with obfuscated fallback infrastructure and throttling. Absence of an npm lifecycle hook does not mitigate the reachable...

This is a concrete import-time remote payload execution chain unrelated to the package's documented menu API. The package is malicious even though it has no npm lifecycle hook.

The import-time loader provides a concrete, unconsented remote payload execution chain. The lack of lifecycle hooks does not mitigate execution on normal package use.

The package’s advertised authentication API has no legitimate need for an import-time, unverified remote binary downloader and detached executor. This is a concrete arbitrary-code executi...

This is a concrete import-time remote payload execution chain unrelated to a pagination component. Lack of lifecycle hooks does not mitigate the reachable runtime execution.

This is an import-time staged payload launcher unrelated to the declared UI package. The concrete download, drop, permission change, and detached execution chain warrants blocking.

The source establishes an import-time staged payload chain ending in detached execution of unauthenticated remote bytes. Lack of npm lifecycle hooks does not mitigate this runtime RCE path.

This is a concrete import-time remote-code-execution chain unrelated to the declared UI package purpose. Absence of lifecycle scripts does not mitigate execution on normal use.

Source directly confirms an import-triggered remote binary downloader and detached launcher; the lack of an npm lifecycle hook does not mitigate runtime import execution.

This is a concrete import-time remote-code-execution chain, not ordinary telemetry: fetched executable bytes are launched without validation. Lack of an install hook does not mitigate the...

The remote payload is not authenticated and is immediately executed on ordinary package import. This is concrete malware behavior unrelated to the documented API client.

Source inspection confirms import-time remote binary staging and execution. No user action, explicit configuration, or lifecycle hook is required beyond loading the package.

This is a concrete, import-triggered remote native payload execution chain unrelated to the advertised widget. The duplicate telemetry implementation corroborates the same downloader/laun...

The advertised interceptor has no functional connection to hidden import-time remote executable delivery. This is a concrete remote-code-execution chain, not merely telemetry behavior.

This is a concrete staged payload chain reachable on ordinary import, not a configured telemetry feature. No lifecycle hook is needed because the malicious action runs from the main entry...

The import-time downloader/executor is concrete, stealthy, and unrelated to the package's stated visual-components purpose. The separate telemetry source contains the same remote-extensio...

The package has no install hook, but its normal import path executes a concealed downloader and launcher. The telemetry file independently implements the same payload-delivery pattern.

The advertised feature-toggle entrypoint has no need for an import-time remote binary bootstrap. The concrete downloader-to-temp-file-to-detached-execution chain is malicious.

This is a concrete, automatically reachable remote binary staging and execution chain concealed behind an unrelated DI package API. The absence of lifecycle scripts does not mitigate impo...