npm security reports, with evidence.

The package's main entrypoint performs import-time download-and-execute behavior unrelated to its stated reactive-store purpose. No lifecycle hook is needed because ordinary package use t...

OpenSSF/OSV malware advisory MAL-2026-13323 blocks this version. On require, index.js loads _ext.js which detects platform, constructs C2 hostnames by joining split string fragments (e.g....

This is concrete import-time remote code execution, not package-aligned telemetry. No lifecycle hook is needed because requiring the declared main entrypoint activates the loader.

This is a concrete import-time staged-payload execution chain unrelated to a navigation router. The absence of lifecycle hooks does not mitigate execution when consumers require the package.

Source directly establishes an automatic remote-payload download-and-execute chain. No install hook is needed because normal runtime import activates it.

Concrete source shows unconsented import-time download-and-execute behavior with obfuscated endpoints and no legitimate uploader implementation. Absence of lifecycle scripts does not miti...

This is a concrete, automatic remote-code-execution chain on package import, unrelated to the advertised lightweight SDK interface.

This is a concrete import-time staged payload execution chain, unrelated to the stated select-fields functionality. The lack of an npm lifecycle hook does not mitigate execution on normal...

This is a concrete import-time staged-payload execution chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate arbitrary code execution on package import.

OpenSSF/OSV malware advisory MAL-2026-12735 blocks this version. On require('devplatform-react-form'), index.js loads _adapter.js which fetches a platform-specific native binary from hard...

OpenSSF/OSV malware advisory MAL-2026-12737 blocks this version. devplatform-react-micro-frontend@35.2.1 is a lure package whose main entry auto-loads _adapter.js on require. _adapter.js...

OpenSSF/OSV malware advisory MAL-2026-12743 blocks this version. On require of the package, index.js loads _helpers.js which reconstructs Cloudflare Workers hostnames via array-join strin...

This is concrete import-time remote payload execution, not package-aligned version-checking or benign telemetry. Lack of lifecycle hooks does not mitigate execution when the documented im...

This is concrete import-time staged payload delivery and execution, not legitimate package-aligned telemetry. Lack of an npm lifecycle hook does not mitigate runtime compromise of consumers.

The package’s benign exported class is paired with an unconditional import-time downloader/executor. The remote opaque binary is neither package-aligned nor integrity-verified despite a m...

Direct source inspection confirms an import-time remote payload downloader and launcher; the benign-looking API does not invoke or document it. This is concrete malware behavior, not ordi...

This is concrete import-time remote payload execution, not a package-aligned utility feature. The absent install hook does not mitigate execution on ordinary use.

The package's import path directly activates an obfuscated remote binary downloader and executor. The absence of an install hook does not mitigate runtime compromise on normal import.

This is a concrete import-time remote payload execution chain, not legitimate package-aligned telemetry. The absence of lifecycle hooks does not mitigate execution on normal package use.

This is a concrete import-time staged-payload execution chain unrelated to the package’s stated interface. Absence of an npm lifecycle hook does not mitigate execution on normal module im...

The remote payload is not package-aligned application functionality and is executed automatically on import, making this a concrete arbitrary-code execution chain.