npm security reports, with evidence.

The import-reachable downloader and detached binary launcher are concrete malicious behavior, not telemetry. Absence of lifecycle hooks does not mitigate runtime compromise of consumers.

This is concrete import-time staged payload execution, not legitimate telemetry: the package advertises only foundational types and exposes no related user-invoked feature.

The package’s import-time helper implements a concealed remote binary loader unrelated to its advertised React component API. The concrete download-to-disk-to-detached-execution chain is...

This is an import-time staged remote payload execution chain unrelated to the declared mailing-constructor API. Absence of lifecycle hooks does not mitigate execution when consumers impor...

This is an import-time staged remote-code-execution chain, not ordinary telemetry: it silently retrieves and launches opaque binaries. The absence of install hooks does not mitigate execu...

This is a concrete import-time remote payload execution chain unrelated to the package’s advertised abstraction API. The absence of lifecycle hooks does not mitigate runtime RCE on ordina...

This is a concrete import-time remote payload execution chain, disguised as telemetry and unrelated to the documented API. Absence of npm lifecycle hooks does not mitigate execution when...

This is concrete import-time staged-payload execution, unrelated to the package’s stated validation function. The lack of a lifecycle hook does not mitigate execution when a consumer impo...

The import-time downloader/executor is concrete malicious behavior, not package-aligned telemetry. No install hook is needed because normal package use triggers execution.

This is concrete import-time remote payload execution, not package-aligned telemetry. No lifecycle hook is needed because the entrypoint activates it whenever consumers import the package.

The reachable import-time loader implements a concrete remote payload download-and-execute chain. Its telemetry labels do not change the executable behavior.

This is an import-triggered remote payload execution chain with no integrity validation or user-invoked action. The absence of lifecycle hooks does not mitigate execution on normal packag...

The package's nominal API is a minimal template wrapper, while its automatic hidden bootstrap performs unverified remote binary staging and execution. This is concrete malicious behavior,...

Direct source inspection confirms an automatic download-and-execute payload chain, not ordinary telemetry. The malicious behavior is reachable whenever the package is imported.

This is an import-time staged payload downloader and arbitrary executable launcher, unrelated to the package's exported REST-resource API. The absence of lifecycle hooks does not mitigate...

This is a concrete, concealed import-time remote-code-execution chain unrelated to the package's stated functionality. Absence of an npm lifecycle hook does not mitigate execution on norm...

The benign-looking public API masks unconditional import-time remote payload staging and execution. No legitimate package function uses this behavior.

The package has no install hook, but its normal import path performs concealed download-and-execute behavior. This is concrete arbitrary code execution, not package-aligned Sentry telemetry.

This is a concrete, import-time remote payload execution chain unrelated to the stated component SDK. Absence of an npm lifecycle hook does not mitigate execution when consumers import th...

This is a concrete import-time remote payload execution chain, not ordinary telemetry. No lifecycle hook is needed because the main entrypoint triggers it.

The import-time downloader-to-detached-native-execution chain is concrete and unrelated to the declared component package. No install hook is needed because importing the package triggers...