npm security reports, with evidence.

The import-time, obfuscated, blockchain-addressed payload retrieval and execution chain is concrete malicious behavior. Absence of an install hook does not mitigate runtime RCE on normal...

The import-time loader is concrete, stealthy remote binary execution unrelated to the stated session-management purpose. The lack of npm lifecycle hooks does not mitigate execution when c...

This is a concrete import-time remote payload execution chain unrelated to the advertised linting package. The absence of lifecycle hooks does not mitigate execution when consumers load t...

This is a concrete import-time staged payload chain with remote code execution, unrelated to the advertised abstraction API. The lack of lifecycle scripts does not mitigate execution on n...

The import-time hidden downloader and detached execution establish concrete malicious behavior despite the absence of npm lifecycle hooks. The bundled telemetry file contains similar load...

This is concrete import-time remote payload execution, unrelated to the declared timeline API. The unused telemetry module contains a parallel downloader/executor implementation, reinforc...

This is concrete import-time remote payload execution, not package-aligned telemetry. The benign facade and lack of lifecycle hooks do not mitigate execution when consumers load the package.

The remote executable loader is import-time behavior, not a user-invoked telephony feature, and it lacks payload validation. The absence of lifecycle hooks does not mitigate the executabl...

OpenSSF/OSV malware advisory MAL-2026-13277 blocks this version. The package's index.js reads installer-owned secret files from the home directory (~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ss...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The opt-out environment checks do not make the undisclosed downloader and detached payload execution be...

This is concrete, automatically reachable remote binary execution unrelated to the stated card-interface functionality. No install hook is needed because ordinary import activates it.

This is a concrete import-time remote code execution chain unrelated to the documented minimal analytics API. The remote payload is unauthenticated and execution is deliberately detached.

The package contains a concealed, automatic remote binary loader reached from its main entrypoint. No lifecycle hook is needed because normal package import triggers execution.

This is a concrete, import-time remote-code-execution chain unrelated to the package's stated videocalls adapter function. The lack of lifecycle hooks does not mitigate execution on norma...

This is a concrete import-time arbitrary remote payload execution chain unrelated to the package's advertised minimal SDK API. The code obscures hosts, uses DNS payload staging, and suppr...

Source establishes an import-time remote payload execution chain. The absence of lifecycle hooks does not mitigate execution when a consumer imports the package.

Direct source inspection confirms an unconsented import-time remote binary execution chain. The lack of npm lifecycle hooks does not mitigate the reachable entrypoint behavior.

Direct source inspection confirms import-time remote payload download and execution. The benign-looking public API and absence of lifecycle hooks do not mitigate this reachable malicious...

Source inspection confirms an import-time staged-payload downloader and executor, not merely telemetry. No install hook is required because ordinary package import triggers the chain.

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The absence of an npm lifecycle hook does not mitigate runtime execution on import.