npm detections from LPM Firewall.

This is a concrete, reachable remote payload execution chain, not ordinary telemetry. Lack of an npm lifecycle hook only limits the trigger to package import.

This is a concrete import-time staged-payload and remote-execution chain unrelated to the declared UI toolkit. The absence of lifecycle hooks does not mitigate execution through the norma...

This is a concrete import-time remote-code-execution chain unrelated to the declared config SDK functionality. The lack of npm lifecycle hooks does not mitigate runtime import execution.

The malicious loader is reachable at import time and executes unverified remote bytes. No lifecycle hook is required for the attack to affect package consumers.

This is a concrete import-time remote payload execution chain unrelated to the exported metrics collector. The absent npm lifecycle hook does not mitigate execution on normal package import.

The package has a concrete import-time download-and-execute chain with obfuscated endpoint construction and DNS fallback. This is remote code execution, not package-aligned telemetry.

This is a concrete import-time staged payload loader and remote code execution chain, not ordinary telemetry. The unused telemetry module contains a parallel configurable loader design, r...

This is an import-time staged payload loader with covert fallback transport and detached execution; it is unrelated to the documented abstraction-layer API.

This is a concrete, import-time remote payload execution chain unrelated to the package's stated minimal API. The lack of lifecycle scripts does not mitigate execution when consumers impo...

The package's declared icon/adapter behavior does not justify hidden import-time remote binary execution. The directly inspected loader establishes a concrete staged-malware chain.

This is concrete import-time remote payload execution, not normal telemetry. No installation hook is needed because any consumer runtime import triggers it.

The package's declared EventBus/test-fixture purpose does not justify an import-time remote binary loader. The concrete download-and-execute chain establishes malicious behavior.

Source inspection confirms an import-time downloader and detached payload launcher, not just suspicious primitives. The absence of lifecycle hooks does not mitigate execution on normal im...

This is a concrete import-time staged payload chain with arbitrary binary execution, unrelated to the advertised pub/sub adapter. The absence of npm lifecycle hooks does not mitigate the...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The absence of npm lifecycle hooks does not mitigate activation through the package main entrypoint.

The package contains an import-time, obfuscated remote payload loader that executes unverified downloaded binaries. Lack of lifecycle hooks does not mitigate the reachable runtime attack...

This is concrete import-time remote payload execution with concealed delivery infrastructure and no usable integrity check. It is unrelated to the exposed payments API.

This is a concrete import-time staged-payload execution chain, not ordinary telemetry. The larger telemetry module independently contains the same payload-download-and-launch capability w...

This is concrete import-time remote payload execution, unrelated to the advertised metrics collector. The absence of an install hook does not mitigate execution when consumers import the...

This is a concrete, automatic remote-payload execution chain unrelated to the declared carousel functionality. It is malicious despite having no npm lifecycle script.

The reachable import-time loader provides a concrete arbitrary remote code execution chain, not legitimate telemetry behavior. Lack of an npm lifecycle hook does not mitigate execution on...