npm security reports, with evidence.

The package's normal import path contains a concealed, unauthenticated remote payload execution chain unrelated to its stated data-mapper/persistence-adapter purpose. This is concrete mal...

This is concrete import-time remote payload execution, not legitimate telemetry. The absence of lifecycle hooks does not mitigate execution when consumers load the package.

This is a concrete import-time staged payload chain with remote binary execution, unrelated to the declared state-management functionality. Lack of lifecycle hooks does not mitigate runti...

The payload chain is reachable on normal import and performs remote binary execution. The absent lifecycle script does not mitigate this import-time behavior.

The package implements concrete import-time remote payload execution, not ordinary telemetry. The benign logger façade and absent lifecycle hook do not mitigate this runtime attack path.

This is a concrete, automatic remote-code-execution chain unrelated to the advertised lightweight header wrapper. The unused telemetry module independently contains the same payload-loade...

This is a concealed import-time remote binary downloader and executor, unrelated to the declared floating-button library purpose. The absence of an npm lifecycle hook does not mitigate th...

This is an import-time staged remote-code-execution loader unrelated to the declared UI-component package. The absent lifecycle hook does not mitigate automatic execution when consumers i...

This is a concrete import-time remote payload execution chain, unrelated to the package's advertised abstraction API. No install hook is required for compromise once a consumer imports it.

This is an import-time staged payload loader with remote binary execution, unrelated to the documented minimal adapter API. No lifecycle hook is needed because requiring the package activ...

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The obfuscated endpoint construction and detached execution establish malicious behavior.

The package's public import path reaches a concealed downloader/executor without user action. The telemetry file also contains substantially the same payload staging and execution design.

This is concrete import-time remote code execution, not ordinary telemetry: opaque network-delivered bytes are directly executed. Absence of an npm lifecycle hook does not mitigate the au...

This is concrete import-time remote-code execution unrelated to the declared component package. The absence of install hooks does not mitigate execution on ordinary package use.

This is a concrete import-time staged payload execution chain, not telemetry: unverified remote bytes are written and executed without user action.

This is a concrete import-triggered remote-code-execution chain unrelated to the declared library functionality. Absence of lifecycle hooks does not mitigate runtime compromise of consumers.

The package has an import-time staged payload chain with no integrity validation and detached execution. The telemetry naming and opt-out variables do not align with its binary download-a...

This is concrete import-time remote code execution, not legitimate telemetry: no payload authenticity check is enforced and the downloaded binary is executed detached. Block publication.

The package has no legitimate SDK functionality beyond a minimal class, while import-time code performs covert remote binary staging and execution. This is a concrete arbitrary-code-execu...

The entrypoint makes remote payload execution import-time behavior, not an inert or user-invoked utility. Lack of lifecycle hooks does not mitigate arbitrary execution when an application...

This is concrete import-time remote payload execution unrelated to the advertised lightweight wrapper. No integrity verification or user action protects the downloaded executable.