npm security reports, with evidence.

The import-time remote payload execution chain is concrete and independent of install hooks. It is incompatible with the declared lightweight module-loader purpose.

Direct source inspection confirms an import-time staged payload loader with remote native execution. The absence of lifecycle scripts does not mitigate execution through the package main...

The package entrypoint reaches a concealed remote binary downloader and detached executor during import. No user action, configuration, integrity verification, or legitimate notifier func...

The package has a concrete import-time remote-code-execution chain with no consent, verification, or package-aligned purpose. Lack of npm lifecycle hooks does not mitigate this runtime tr...

This is a concrete import-time remote payload execution chain, not telemetry: downloaded bytes are written and executed without validation or user action. The benign-looking exported API...

This is a concrete, hidden import-time remote-code-execution chain unrelated to the advertised feature-toggle API. No install hook is required for the payload to execute once the package...

Direct source inspection confirms reachable import-time download-and-execute behavior with obfuscated infrastructure and no payload integrity verification. The lack of lifecycle hooks doe...

This is concrete import-time remote code execution, not normal module-loader behavior. The unused telemetry-like implementation in lib/telemetry.js reinforces the deceptive payload-loader...

This is a concrete, import-triggered staged payload loader and detached executor, unrelated to the documented query abstraction. Absence of install hooks limits the trigger to runtime imp...

The import-time, unverified remote payload execution chain is concrete and complete in _loader.js. Absence of lifecycle scripts does not mitigate runtime execution when consumers import t...

This is concrete import-time remote payload execution, not ordinary telemetry. The absence of lifecycle hooks does not mitigate execution when consumers require the package.

The undocumented import-time download-and-execute chain is concrete malicious behavior, independent of the lack of npm lifecycle hooks. Its stated token API does not require telemetry or...

The declared mock-builder package has no legitimate reason to fetch and execute opaque native payloads during import. This is a concrete import-time remote-code-execution chain.

The hidden loader is import-reachable and performs unconsented remote binary execution; this is incompatible with the declared UI toolkit function.

This is a concrete hidden remote-code-execution chain activated by ordinary import, not a package-aligned UI feature or user-invoked setup action.

This is concrete, silent import-time remote code execution with no integrity verification and no package-aligned functionality. The absent install hook does not mitigate execution wheneve...

The package contains a concrete, automatically reachable import-time remote payload download-and-execute chain. No legitimate package functionality requires this hidden behavior.

This is a concrete import-time remote-code-execution chain, not legitimate telemetry: downloaded bytes are executed as a detached process. The lack of lifecycle hooks does not mitigate th...

The package contains an import-time, concealed downloader and detached native-payload launcher. No user action beyond importing the package is required.

This is a concrete, automatically reachable remote-payload execution chain unrelated to the declared visual-components purpose. Absence of install hooks does not mitigate import-time arbi...

This is concrete, stealthy remote code execution on ordinary package import, unrelated to the advertised REST client. The lack of lifecycle hooks does not mitigate the import-time executi...