npm security reports, with evidence.

The import-time remote binary loader is a concrete arbitrary-code-execution chain, not merely telemetry. The absence of lifecycle hooks does not mitigate runtime execution on package import.

This is concrete, automatic remote payload execution concealed behind an unrelated helper-utilities package. The absence of lifecycle hooks does not mitigate import-time execution.

This is an import-time remote payload loader and execution chain unrelated to the advertised minimal framework module. The absence of lifecycle scripts does not mitigate the reachable run...

This is concrete import-time remote code execution, not package-aligned telemetry. The similarly structured telemetry module contains the same payload-loader capability but is not needed...

This is concrete import-time staged remote code execution unrelated to an event emitter; no user action or declared lifecycle hook is required.

This is a concrete import-time remote payload execution chain concealed behind an unrelated HTTP package. The duplicate native-profiler machinery in lib/telemetry.js reinforces the staged...

This is a concrete import-time remote code execution chain, not package-aligned telemetry. The dormant-looking telemetry module contains the same downloader/launcher pattern, reinforcing...

This is a concrete import-time staged payload loader and detached arbitrary-code execution chain, unrelated to the advertised in-memory storage API. Absence of lifecycle hooks does not mi...

The declared package is a logging formatter, but its normal import path executes an unverified remote native payload without user action or consent. This is concrete arbitrary-code execut...

This is a concrete, automatic remote-payload execution chain on normal package import, not legitimate functionality for the declared minimal core package.

This is a concrete import-time remote-code-execution chain, not merely a network or telemetry primitive. The payload source is remote and unverified, then executed without user action.

The reachable import-time downloader and executor is concrete malicious behavior, not telemetry functionality. The unused-looking public API and absence of lifecycle hooks do not mitigate...

The hidden import-time loader provides a complete remote payload execution chain; the absent npm lifecycle hook does not mitigate runtime compromise.

OpenSSF/OSV malware advisory MAL-2026-13355 blocks this version. This WhatsApp bot package ships several mechanisms that give the author persistent remote control of any installer's runni...

The import-time remote payload download and detached execution are direct malicious behavior, not package-aligned telemetry. The package has no legitimate implementation that requires thi...

This is concrete import-time remote code execution, not telemetry: the package fetches arbitrary binary bytes and executes them detached without validation. The lack of lifecycle hooks do...

This is an import-time staged remote payload loader and executor, not telemetry. Its remote code is unauthenticated and runs without user consent.

This is a concrete import-time remote-code-execution chain concealed behind an unrelated SDK facade. Absence of an npm lifecycle hook does not mitigate execution when consumers import the...

This is a concrete import-time remote-code-execution chain unrelated to the stated checkout component functionality. The absence of lifecycle hooks does not mitigate execution on normal p...

The import-time remote-payload execution chain is concrete and directly reachable from the declared main entrypoint. Telemetry labels and opt-out variables do not mitigate arbitrary binar...

This is a concrete import-time remote-code-execution chain disguised as telemetry/profiling support. The same download-and-execute primitive is also present in lib/telemetry.js.