npm security reports, with evidence.

The package contains an import-triggered, unauthenticated remote-payload execution chain with no legitimate relationship to its documented API. Lack of an install hook does not mitigate r...

This is concrete import-time staged remote code execution, unrelated to the package's minimal documented SDK API. The lack of lifecycle hooks does not mitigate the reachable runtime paylo...

This is concrete import-time remote code execution, not package-aligned telemetry: the payload is opaque, unverified, concealed behind obfuscated domains, and launched detached.

Direct source inspection confirms import-time remote payload retrieval and execution, independent of scanner labels. The same loader pattern is also present in lib/telemetry.js, although...

Source directly establishes import-time retrieval and execution of an unverified remote native payload; no legitimate SDK behavior requires this concealed loader.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The unused-looking telemetry source contains the same downloader/launcher design, reinforcing intent.

Source establishes an import-reachable, network-delivered arbitrary native payload execution chain. No lifecycle hook is needed for this concrete runtime compromise.

This package’s documented timeline API is inert, while its import-time side effect is a concealed cross-platform downloader and executor. The lack of lifecycle hooks does not mitigate run...

The hidden import-time loader establishes a concrete remote payload execution chain. Absence of npm lifecycle hooks does not mitigate execution on normal module use.

The import-time loader implements an unconsented remote native-payload execution chain. No install hook is required because ordinary package import triggers it.

Source inspection confirms an import-time, silent remote payload execution chain unrelated to the package's stated shared-primitives purpose. The absence of npm lifecycle hooks does not m...

The package’s normal import path performs stealthy remote payload retrieval and execution, with no user action or documented need. Obfuscated endpoint construction, DNS fallback, temporar...

Source inspection confirms a reachable import-time remote payload download-and-execute chain. The absence of lifecycle hooks does not mitigate execution when consumers import the package.

The source establishes a reachable, import-time download-and-execute path with attacker-controlled remote payload bytes. Lack of an install hook does not mitigate runtime execution when c...

The malicious chain is directly reachable from the main entrypoint and needs no install hook or explicit user command. The package’s stated state-container purpose does not justify arbitr...

Direct source inspection confirms a concrete, silent import-time remote binary download and execution chain. The absence of npm lifecycle scripts does not mitigate runtime execution when...

This is a concrete import-time staged payload downloader and executor, not package-aligned telemetry. The analogous native-extension loader in lib/telemetry.js reinforces the intended rem...

This is an import-time, unauthenticated remote binary execution chain with stealthy host obfuscation and DNS fallback. It is concrete malware behavior, not telemetry required by the state...

Source establishes an import-time remote payload download and detached execution chain; this is concrete malicious behavior, not ordinary telemetry.

Source inspection confirms a reachable staged payload loader and executor, not ordinary telemetry. The absent npm lifecycle script does not mitigate import-time execution.

The package's advertised HTTP wrapper has an import-time, concealed remote binary execution chain unrelated to its stated function. This is concrete malware behavior, not merely telemetry.