npm security reports, with evidence.

This is a concrete, automatic staged-payload execution chain unrelated to the documented in-memory token API. Absence of lifecycle hooks does not mitigate import-time remote code execution.

OpenSSF/OSV malware advisory MAL-2026-13357 blocks this version. On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesti...

This is a concrete, import-time staged payload execution chain unrelated to the advertised static-analysis configuration. The absence of lifecycle hooks does not mitigate arbitrary code e...

Source directly establishes import-time download-and-execute behavior with no user command or consent boundary. The telemetry module independently contains the same payload-loader pattern...

This is a concrete, stealthy remote-payload execution chain activated by a normal package import. The telemetry naming and opt-out variables do not constrain the downloaded code or make t...

This is concrete automatic remote payload execution on package import, unrelated to the documented test-harness functionality. It is malicious regardless of the absence of npm lifecycle h...

This is concrete, silent import-time remote payload staging and execution, not ordinary telemetry. No lifecycle hook is needed because requiring the advertised package API triggers it.

This is concrete import-time remote code execution, not ordinary telemetry: unverified remote bytes are silently executed as a detached process. The absence of an npm lifecycle hook does...

The import-time downloader-and-executor in setup.js is a concrete malicious remote-code-execution chain, regardless of the absence of an npm lifecycle hook. lib/telemetry.js independently...

This is a concrete, automatically reachable remote-code-execution chain unrelated to the package's stated DI interface. Absence of install hooks does not mitigate import-time payload exec...

This is concrete import-time remote payload execution unrelated to the advertised UI toolkit. No lifecycle hook is needed because the package main entrypoint reaches the bootstrapper.

The package's simple data-table API does not require binary downloading or execution. Source confirms the dangerous chain is import-time, concrete, and not merely a scanner label.

This is a concrete, import-triggered remote payload execution chain rather than ordinary telemetry. The lack of an npm lifecycle hook does not mitigate execution on normal package use.

This is a concrete import-time staged remote-code-execution chain unrelated to the advertised handler API. The absence of an npm lifecycle hook does not mitigate execution on normal packa...

The package's documented utility entrypoint triggers concealed remote payload download and execution without user action. No legitimate package-aligned use explains this behavior.

Direct source inspection confirms reachable import-time remote payload execution, not merely telemetry behavior. The dormant telemetry module contains a similar downloader, reinforcing in...

This is concrete import-time remote payload execution unrelated to the advertised client abstraction. Opt-out environment checks and lack of an npm lifecycle hook do not mitigate the runt...

The package's claimed UI interface does not need an import-time remote binary loader. This is a concrete hidden remote-code-execution chain, not ordinary telemetry.

This is concrete import-time staged remote-code execution unrelated to the advertised minimal SDK. The source directly establishes payload retrieval, disk drop, and detached execution.

This is a concrete import-time remote-code-execution chain unrelated to the stated product-list API. The similarly structured telemetry module reinforces the payload-loader behavior, but...

This is a concealed import-time downloader and launcher unrelated to the advertised abstraction library. The absence of an npm lifecycle hook does not mitigate the concrete remote-code-ex...