npm security reports, with evidence.

This package contains a reachable, import-time remote payload download-and-execute chain. No install hook is needed for the behavior to affect any application that imports it.

This is an import-time staged remote-code-execution chain unrelated to the advertised UI loader, with concealed endpoints and no payload verification.

This is a concrete import-time remote payload execution chain unrelated to the declared React-components purpose. The absence of lifecycle hooks does not mitigate runtime execution on imp...

The import-time loader is a concrete remote native-code execution chain unrelated to the advertised UI component package. It is sufficient for a blocking malicious verdict.

OpenSSF/OSV malware advisory MAL-2026-13175 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On require('dolyame-ui-popup'), index.js loads _help...

This is concrete import-time remote payload execution, not package-aligned UI functionality. The lack of lifecycle hooks does not mitigate execution whenever the advertised module is loaded.

The import-time bootstrap provides a concrete, unconsented remote payload execution chain unrelated to the advertised UI component. No lifecycle hook is required for exploitation because...

The package has a concrete import-time remote-binary execution chain. Its obfuscation, temporary payload staging, DNS fallback, and detached launch establish malicious intent.

This is a concrete, automatic import-time remote-code-execution chain, not merely telemetry functionality. Absence of an install hook does not mitigate execution when consumers import the...

This is concrete, automatic remote native payload execution unrelated to the advertised UI slider. Absence of lifecycle hooks does not mitigate import-time execution.

This is a concrete, import-time remote code execution chain unrelated to the stated visual-components purpose. Absence of an install hook does not mitigate execution on normal package use.

The import-time downloader/executor is a concrete remote-code-execution chain unrelated to the declared visual-components package. The unused telemetry file reinforces the same pattern bu...

Source inspection confirms an import-time staged payload downloader and executor, not merely telemetry. No lifecycle hook is needed because index.js triggers it whenever the package is lo...

This is concrete import-time remote code execution unrelated to the stated UI-table functionality. The lack of lifecycle hooks does not mitigate the automatic entrypoint trigger.

The import-time bootstrap is a concrete, stealthy remote-code-execution chain. Absence of lifecycle hooks does not mitigate execution on ordinary package import.

This is a concrete import-time remote payload execution chain unrelated to the stated React-components purpose. The absence of lifecycle hooks does not mitigate execution on normal packag...

This is a concrete import-time remote payload execution chain unrelated to the advertised React component package. The absence of lifecycle hooks does not mitigate runtime execution on no...

Concrete import-time download-and-execute behavior is present in the published entrypoint. The lack of an install hook does not mitigate runtime compromise on normal package use.

This is concrete import-time remote code execution unrelated to the declared UI-tooltip functionality. No install hook is required for the attack to execute.

The package has a concrete import-time remote code execution chain, not merely suspicious telemetry primitives. The detached payload execution is concealed behind an unrelated UI API and...

This is a concrete import-time remote payload execution chain unrelated to the advertised React type/component package. The lack of install hooks does not mitigate execution on ordinary p...