npm security reports, with evidence.

The malicious behavior is source-confirmed and reachable on ordinary import, despite no install lifecycle hook. The large telemetry module reinforces the same staged executable pattern.

The import-time remote binary staging and detached execution chain is concrete and requires no caller opt-in. The unused telemetry module contains a similar configurable loader, reinforci...

This is a concrete import-time staged payload loader and arbitrary code execution chain, unrelated to the advertised wrapper functionality. Absence of an npm lifecycle hook does not mitig...

This is a concrete import-time remote payload execution chain unrelated to the advertised component package. The unreferenced telemetry module contains substantially similar native-payloa...

The package's stated API does not require a native executable, yet import-time code silently downloads and executes one with no meaningful integrity verification. The remote payload sourc...

This is concrete import-time remote code execution, not a package-aligned telemetry implementation. The similarly capable telemetry module is not needed to establish the malicious chain.

This is concrete unconsented remote native payload execution on normal package import, not legitimate telemetry. The lack of lifecycle hooks does not mitigate the reachable import-time ex...

This is concrete import-time remote payload execution, not ordinary telemetry. The loader is concealed behind a benign entrypoint and uses multiple remote fallback channels.

This is a concrete import-time remote payload delivery and execution chain unrelated to the package's stated markdown adapter API. The lack of lifecycle hooks does not mitigate execution...

OpenSSF/OSV malware advisory MAL-2026-12496 blocks this version. package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site...

OpenSSF/OSV malware advisory MAL-2026-12473 blocks this version. table-ui-new@2.7.4 ships dist/config.js, exposed via the package.json `./config` subpath export, which exports a module-le...

Source establishes an import-time, unauthenticated remote-code-execution chain; it is not legitimate telemetry. The lack of an install hook does not mitigate execution during normal packa...

The hidden import-time loader provides a concrete remote binary execution chain, independent of npm lifecycle hooks. The benign-looking exported class does not justify that behavior.

This is a concrete import-time remote code execution chain, not ordinary telemetry. The package’s trivial public API does not justify hidden binary staging and detached execution.

The package has no legitimate implementation beyond a small stub, while its import-time vendor code performs unauthenticated remote payload execution. This is a concrete malware execution...

This is a concrete import-time staged payload chain with remote code execution, not ordinary telemetry. The unused telemetry file also contains materially similar downloader/launcher prim...

This is a concrete, automatic remote-payload execution chain triggered by import. The lack of an npm lifecycle hook does not mitigate the import-time execution.

Concrete import-time remote payload execution is present in _ext.js and is reachable from the declared main entrypoint. This is malicious behavior, not package-aligned telemetry.

The public entrypoint activates a concealed downloader/executor at import time. Its network fallback, hidden temp payload, and detached execution are not package-aligned scroll functional...

OpenSSF/OSV malware advisory MAL-2026-12422 blocks this version. quorvex@0.2.1 ships index.mjs as the package main, containing a base64-encoded Windows PE (~355KB) in a PAYLOAD constant....

This is a concrete import-time remote-code-execution chain, not ordinary telemetry: arbitrary downloaded bytes are executed silently and detached. The unused-or-unreferenced telemetry mod...