npm security reports, with evidence.

The import-time loader is concrete remote payload execution, not package-aligned API behavior. Telemetry code independently contains the same download-and-launch primitive.

The package contains an import-time downloader and detached executor for remotely supplied native payloads. No legitimate package functionality requires this behavior.

The claimed domain wrapper has no legitimate connection to import-time remote binary execution. This is a concrete remote payload execution chain, not a scanner-only inference.

Direct source inspection confirms an import-time remote binary loader and detached executor. No lifecycle hook is needed because normal package use triggers it.

This is concrete import-time remote payload execution, not normal telemetry. The unused-looking telemetry module independently contains a similar downloader design, reinforcing intent.

This is a concrete import-time remote payload execution chain, not normal telemetry. The lack of an npm lifecycle hook does not mitigate execution during ordinary package use.

This is a concrete import-time remote code execution chain unrelated to the documented lightweight wrapper, with obfuscated endpoints and no payload verification.

This is a concrete import-time staged-payload execution chain, not legitimate telemetry. No lifecycle hook is needed because normal package use activates it.

The entrypoint reaches concrete remote payload download and execution code at import time. Lack of an install hook does not mitigate this runtime remote-code-execution behavior.

Concrete import-time remote payload acquisition and execution establishes malicious behavior. The absence of an npm lifecycle hook does not mitigate the reachable import-time loader.

This is concrete import-time remote payload execution, not configuration-loading functionality. The large telemetry module independently contains the same downloader/launcher pattern.

The import-time, hard-coded remote binary download and detached execution form a concrete arbitrary-code-execution chain; the lack of lifecycle hooks does not mitigate it.

This is a concrete import-time staged-payload and arbitrary-code-execution chain, unrelated to the advertised decorators API. No lifecycle hook is needed because requiring the declared ma...

The package’s exported abstraction does not require native payload retrieval or detached execution. Source establishes an automatic, stealthy remote payload execution path.

The public adapter entry point has no reason to silently retrieve and execute an unsigned native payload. This is a concrete import-time remote-code-execution chain.

This is a concrete, automatic remote-code-execution chain activated by normal module import. The absent npm lifecycle hook does not mitigate the import-time behavior.

The package’s advertised interface is trivial, while its import path performs covert remote payload retrieval and execution. This is concrete malicious behavior even without an npm lifecy...

The package's advertised API is a trivial object, while its import path silently performs a concealed remote-binary execution chain. No lifecycle hook is needed because ordinary package i...

This is a concrete, automatically reachable remote binary download-and-execute chain, not legitimate form-component behavior.

This is a concrete import-time remote-payload execution chain, not normal telemetry. The absence of lifecycle scripts does not mitigate execution when consumers import the package.

The harmless-looking API imports an immediate remote payload loader. Its download, temporary drop, and detached execution behavior is concrete malware behavior rather than legitimate pack...