npm security reports, with evidence.

This is concrete, automatically triggered remote payload execution unrelated to the advertised test utilities. Absence of install hooks does not mitigate import-time execution.

This is a concrete, silent remote-payload execution chain reachable through the package's normal entrypoint, not legitimate telemetry behavior. No install hook is required for the impact.

The behavior is reachable on ordinary import, uses obfuscated endpoint construction and DNS fallback, and executes unverified remote bytes. The absence of npm lifecycle hooks does not mit...

This is a concrete import-time staged-payload chain, not package-aligned telemetry. It enables arbitrary remote code execution without user action.

The manifest lacks install hooks, but the normal runtime entrypoint reaches an immediate remote payload loader. The source establishes concrete malicious behavior, not merely telemetry.

The import-time loader provides a direct, obfuscated download-and-execute chain with no user opt-in. Absence of lifecycle hooks does not mitigate execution when consumers import the decla...

This is a concrete import-time remote code execution chain disguised as telemetry and unrelated to the published adapter API. No lifecycle hook is needed because ordinary package consumpt...

The source establishes an import-time remote download-and-execute chain with no integrity validation. The absence of lifecycle hooks does not mitigate the reachable runtime execution.

The import-time remote payload execution chain is concrete and independent of lifecycle scripts. The large telemetry module contains the same downloader/launcher pattern but is not needed...

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The hidden loader and DNS fallback make the downloaded executable attacker-controlled and unauditabl...

This is a concrete import-time remote payload execution chain unrelated to the stated legacy wrapper functionality. The absence of install hooks does not mitigate execution when consumers...

The package’s minimal public API does not justify its unconditional covert native payload loader. No install hook is needed because the behavior activates on ordinary import.

The benign wrapper is a cover for reachable import-time remote payload execution. No install hook is needed because normal use of the declared main entrypoint activates the chain.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate execution triggered by importing the documented pac...

This is concrete import-time remote payload execution, not package-aligned telemetry. The absence of a lifecycle hook does not mitigate the automatic require-time execution.

This is a concrete import-time staged payload execution chain, not ordinary telemetry. Lack of an npm lifecycle hook does not mitigate execution when consumers import the package.

This is a concrete import-time staged payload execution chain, not package-aligned telemetry. The unused-looking telemetry module contains a parallel configurable downloader/launcher desi...

This is an import-time remote payload execution chain unrelated to the package's documented component API. It is concrete malicious behavior, not telemetry.

This is a concrete import-time remote code execution chain unrelated to the advertised dependency-hash API. The obfuscated endpoints, DNS payload fallback, hidden drop files, and detached...

The malicious chain is concrete, reachable at import time, and silently executes unverified remote bytes. No lifecycle hook is needed for this runtime compromise.

This is a concrete import-time staged payload and execution chain unrelated to the package's minimal exported SDK. The lack of an install hook does not mitigate arbitrary code execution t...