npm detections from LPM Firewall.

The package's documented auth API is unrelated to its import-time remote binary loader. No lifecycle script is needed because ordinary package import triggers the execution chain.

This is a concrete import-time remote code execution chain, not legitimate telemetry. The large telemetry module contains a parallel implementation, reinforcing deliberate payload-loader...

This is a concrete import-time staged payload execution chain unrelated to the advertised cobrowsing interface. The lack of install hooks does not mitigate execution when consumers import...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The included telemetry module independently contains the same remote native-loader pattern.

Source directly establishes import-time remote payload retrieval and execution; no lifecycle hook is needed for the attack to trigger. The benign exported wrapper and lack of declared dep...

This is a concrete import-time staged-payload execution chain unrelated to the stated error-boundary library. Lack of lifecycle hooks does not mitigate execution when consumers import the...

Source directly establishes an import-time remote payload execution chain. The absence of an install lifecycle hook does not mitigate execution when the package is used.

The import-time remote payload execution chain is concrete and independent of install hooks. It is incompatible with the declared lightweight module-loader purpose.

Direct source inspection confirms an import-time staged payload loader with remote native execution. The absence of lifecycle scripts does not mitigate execution through the package main...

The package entrypoint reaches a concealed remote binary downloader and detached executor during import. No user action, configuration, integrity verification, or legitimate notifier func...

The package has a concrete import-time remote-code-execution chain with no consent, verification, or package-aligned purpose. Lack of npm lifecycle hooks does not mitigate this runtime tr...

This is a concrete import-time remote payload execution chain, not telemetry: downloaded bytes are written and executed without validation or user action. The benign-looking exported API...

This is a concrete, hidden import-time remote-code-execution chain unrelated to the advertised feature-toggle API. No install hook is required for the payload to execute once the package...

Direct source inspection confirms reachable import-time download-and-execute behavior with obfuscated infrastructure and no payload integrity verification. The lack of lifecycle hooks doe...

This is concrete import-time remote code execution, not normal module-loader behavior. The unused telemetry-like implementation in lib/telemetry.js reinforces the deceptive payload-loader...

This is a concrete, import-triggered staged payload loader and detached executor, unrelated to the documented query abstraction. Absence of install hooks limits the trigger to runtime imp...

The import-time, unverified remote payload execution chain is concrete and complete in _loader.js. Absence of lifecycle scripts does not mitigate runtime execution when consumers import t...

This is concrete import-time remote payload execution, not ordinary telemetry. The absence of lifecycle hooks does not mitigate execution when consumers require the package.

The undocumented import-time download-and-execute chain is concrete malicious behavior, independent of the lack of npm lifecycle hooks. Its stated token API does not require telemetry or...

The declared mock-builder package has no legitimate reason to fetch and execute opaque native payloads during import. This is a concrete import-time remote-code-execution chain.

The hidden loader is import-reachable and performs unconsented remote binary execution; this is incompatible with the declared UI toolkit function.