npm security reports, with evidence.

The concealed import-time download-and-execute chain is concrete remote code execution and unrelated to the tiny advertised library API. Absence of an npm lifecycle hook does not mitigate...

This is a concrete import-time staged payload and arbitrary native-code execution chain, unrelated to the package's exposed trivial API. The lack of an install hook does not mitigate runt...

Source inspection confirms an import-time remote-code execution chain with no user action or payload integrity verification. The unused-looking telemetry module contains the same download...

This is concrete import-time remote code execution, not telemetry: an opaque remote binary is downloaded, dropped, and launched detached. The lack of lifecycle hooks does not mitigate the...

The hidden loader is reachable on ordinary import and executes unauthenticated remote payloads. Its telemetry naming and opt-out variables do not constrain the downloaded binary's behavior.

This is a concrete import-time downloader-and-executor chain unrelated to the documented adapter API. Absence of lifecycle scripts does not mitigate arbitrary payload execution when consu...

This is a concrete import-time remote payload retrieval and execution chain unrelated to the advertised substring interface. The lack of lifecycle scripts does not mitigate the reachable...

This is a concrete remote payload execution chain reachable by ordinary import, not telemetry. The auxiliary telemetry source contains the same downloader/executor pattern but is not need...

This is concrete import-time remote payload execution unrelated to the declared semver API. Absence of an npm lifecycle hook does not mitigate the runtime RCE path.

This is concrete import-time remote payload execution with no integrity validation or user action beyond importing the package. Absence of an npm lifecycle hook does not mitigate the reac...

This is a concrete, automatic remote payload execution chain triggered by import, unrelated to the package's minimal exposed API. The large telemetry module contains the same capability p...

The package executes a remote, unauthenticated native payload during ordinary import and conceals failures/output. This is concrete malware behavior, not normal telemetry.

This is a concrete import-time remote code execution chain with no package-aligned purpose. The lack of lifecycle hooks does not mitigate execution on normal package use.

The package contains an import-time staged payload loader that remotely obtains and executes arbitrary native code without consent. This is concrete malicious behavior, not telemetry.

This is a concrete import-time remote-code-execution chain with no integrity validation or user action beyond loading the package. The unused telemetry module contains a substantially sim...

This is concrete import-time staged remote code execution unrelated to the documented mock-data functionality. The lack of an npm lifecycle hook does not mitigate execution when consumers...

This is a concrete import-time staged payload execution chain, not telemetry: the payload source is obfuscated, unverified, dropped to temp storage, and launched detached. The unused tele...

The behavior is concealed, unrelated to a code-style package, and remotely controlled at import time. Absence of npm lifecycle hooks does not mitigate this reachable execution chain.

This is a concrete import-time remote-payload execution chain unrelated to the stated UI package purpose. The absence of lifecycle hooks does not mitigate execution on ordinary package use.

OpenSSF/OSV malware advisory MAL-2026-12310 blocks this version. The package's declared main (index.js) unconditionally requires./_init on load. _init.js selects a platform-specific asset...

OpenSSF/OSV malware advisory MAL-2026-12309 blocks this version. On require of the package (index.js loads./_vendor at import), _vendor.js selects a platform-specific staging path, downlo...