npm security reports, with evidence.

This is a concrete import-time staged native payload execution chain unrelated to the small advertised SDK API. The bundled telemetry module independently contains the same downloader/lau...

The malicious behavior is directly reachable on ordinary package import and executes unauthenticated remote content. No lifecycle hook is needed for the package to compromise an applicati...

This is concrete, unconsented remote native payload execution on import, unrelated to the advertised minimal mobile SDK. The absence of an npm lifecycle hook does not mitigate the reachab...

This is concrete import-time remote binary execution unrelated to the declared native-card wrapper. No install hook is needed because ordinary application import triggers the loader.

This is a concrete import-time remote payload download-and-execute chain unrelated to the package's advertised minimal API. No lifecycle hook is needed because the malicious initializer i...

The import-time helper forms a complete remote-payload download, drop, and execution chain unrelated to the advertised context wrapper. No lifecycle hook is needed because ordinary packag...

This is concrete, import-triggered staged payload execution unrelated to the advertised testing utility. The absence of an npm lifecycle hook does not mitigate the runtime compromise path.

Source directly establishes import-time download-and-execute behavior with attacker-controlled remote payload bytes. The lack of lifecycle scripts does not mitigate the reachable import-t...

This is concrete import-time remote code execution concealed behind an unrelated wrapper API. The absence of lifecycle scripts does not mitigate execution when consumers import the package.

The concealed import-time download-and-execute chain is concrete remote code execution and unrelated to the tiny advertised library API. Absence of an npm lifecycle hook does not mitigate...

This is a concrete import-time staged payload and arbitrary native-code execution chain, unrelated to the package's exposed trivial API. The lack of an install hook does not mitigate runt...

Source inspection confirms an import-time remote-code execution chain with no user action or payload integrity verification. The unused-looking telemetry module contains the same download...

This is concrete import-time remote code execution, not telemetry: an opaque remote binary is downloaded, dropped, and launched detached. The lack of lifecycle hooks does not mitigate the...

The hidden loader is reachable on ordinary import and executes unauthenticated remote payloads. Its telemetry naming and opt-out variables do not constrain the downloaded binary's behavior.

This is a concrete import-time downloader-and-executor chain unrelated to the documented adapter API. Absence of lifecycle scripts does not mitigate arbitrary payload execution when consu...

This is a concrete import-time remote payload retrieval and execution chain unrelated to the advertised substring interface. The lack of lifecycle scripts does not mitigate the reachable...

This is a concrete remote payload execution chain reachable by ordinary import, not telemetry. The auxiliary telemetry source contains the same downloader/executor pattern but is not need...

This is concrete import-time remote payload execution unrelated to the declared semver API. Absence of an npm lifecycle hook does not mitigate the runtime RCE path.

This is concrete import-time remote payload execution with no integrity validation or user action beyond importing the package. Absence of an npm lifecycle hook does not mitigate the reac...

This is a concrete, automatic remote payload execution chain triggered by import, unrelated to the package's minimal exposed API. The large telemetry module contains the same capability p...

The package executes a remote, unauthenticated native payload during ordinary import and conceals failures/output. This is concrete malware behavior, not normal telemetry.

This is a concrete import-time remote code execution chain with no package-aligned purpose. The lack of lifecycle hooks does not mitigate execution on normal package use.

The package contains an import-time staged payload loader that remotely obtains and executes arbitrary native code without consent. This is concrete malicious behavior, not telemetry.

This is a concrete import-time remote-code-execution chain with no integrity validation or user action beyond loading the package. The unused telemetry module contains a substantially sim...

This is concrete import-time staged remote code execution unrelated to the documented mock-data functionality. The lack of an npm lifecycle hook does not mitigate execution when consumers...