npm security reports, with evidence.

This is concrete import-time remote payload execution unrelated to the documented types abstraction. The absence of lifecycle hooks does not mitigate execution when consumers import the p...

The package has no install hook, but ordinary import reaches an undeclared remote payload downloader and detached executor. This is concrete malicious runtime behavior, not telemetry.

This is a concrete, import-triggered remote binary execution chain unrelated to the documented claims wrapper. The dormant telemetry module mirrors the same loader design but is not requi...

This is a concrete import-time remote payload execution chain unrelated to the stated claims-visibility API. The absence of lifecycle hooks does not mitigate execution on ordinary package...

The package's normal import path contains an immediately invoked downloader/executor with concealed endpoints and no integrity verification. Absence of npm lifecycle hooks does not mitiga...

This is concrete import-time remote payload execution, not legitimate package functionality. The unused telemetry file is additional suspicious material but is unnecessary to establish th...

This is concrete import-time remote payload execution unrelated to the declared claims API. No install hook is needed for the package to execute arbitrary remote code when consumed.

The malicious execution chain is directly reachable from the main entrypoint and requires no user opt-in. No integrity verification is performed despite the source comment claiming one.

This is a concrete import-time staged-payload execution chain, not ordinary telemetry: unverified remote bytes are silently executed detached. The package has no lifecycle hook, but norma...

This is a concrete import-time remote payload execution chain unrelated to the claimed fixture module. Absence of npm lifecycle scripts does not mitigate runtime compromise upon import.

This is a concrete import-time staged payload loader and remote executor, unrelated to the advertised claims-domain API. The absence of install hooks does not reduce the runtime RCE expos...

The concrete import-time remote payload download and detached execution are malicious behavior, not package-aligned SDK functionality. Absence of lifecycle hooks does not mitigate the rea...

This is a concrete import-time remote payload execution chain unrelated to the advertised REST client wrapper. The package provides no signature, hash, or user-invoked setup boundary for...

Source inspection confirms an import-time staged payload downloader and detached executor, with no legitimate integration path exposed by the advertised wrapper. Absence of an npm lifecyc...

The postinstall hook directly triggers heavily obfuscated local-file collection and axios multipart upload code. This is malicious install-time data exfiltration, not package-aligned beha...

The package's documented claims-conversion API does not require a covert native downloader or detached payload execution. The executable payload is remote-controlled and runs automaticall...

Source directly establishes import-time remote payload retrieval and execution, unrelated to the advertised wrapper API. The absence of an install hook does not mitigate runtime compromis...

This is a concrete import-time remote code execution chain, not merely telemetry behavior. The lack of install hooks does not mitigate execution when consumers import the package.

The package’s stated component API does not require a hidden import-time executable downloader. The direct source establishes a concrete remote payload execution path.

This is a concrete import-time staged payload downloader and executor unrelated to the declared filter API. Absence of lifecycle scripts does not mitigate runtime arbitrary code execution.

The import-time code establishes a complete download-to-execution chain with obfuscated endpoints and no user invocation or integrity verification. Absence of npm lifecycle hooks does not...