npm security reports, with evidence.

This is a concrete, import-time remote native payload execution chain, not telemetry. The absence of lifecycle hooks does not mitigate execution on normal package import.

This is a concrete, hidden remote payload execution chain triggered by a normal import, unrelated to the package’s minimal advertised wrapper API. The lack of an install hook does not mit...

The advertised clipboard SDK has no legitimate need to silently retrieve and execute unverified native payloads at import time. This is concrete remote code execution, independent of the...

Confirmed source establishes a concrete, silent remote-payload execution chain reachable from the package entrypoint. The lack of install hooks does not mitigate runtime compromise on imp...

The package contains concrete import-time download-and-execute behavior, not merely telemetry primitives. The lack of install hooks does not mitigate execution when a consumer imports the...

This is confirmed import-time remote payload execution, not legitimate telemetry. The lack of an npm lifecycle hook does not mitigate execution when consumers import the package.

This is a concrete, import-time remote-code-execution chain with opaque payload delivery and stealth-oriented error suppression. The lack of an npm lifecycle hook does not mitigate runtim...

The package's public entrypoint automatically performs an unauthenticated remote payload retrieval and execution chain. No user action beyond importing the package is required.

This is concrete import-time remote code execution, not ordinary telemetry: fetched opaque bytes are executed without validation. The similar profiler loader in lib/telemetry.js reinforce...

The package contains a concrete, reachable import-time remote payload execution chain unrelated to its advertised minimal interface. This is malicious behavior, not benign telemetry.

This is concrete, automatically triggered remote native payload execution unrelated to the declared visual-components package. The telemetry-themed library duplicates the same downloader/...

The public entrypoint unconditionally triggers an obfuscated downloader-executor at runtime. No legitimate SDK functionality explains remote binary retrieval and detached execution.

This is a concrete import-time staged-payload execution chain unrelated to the documented core-runtime API. Absence of an install hook does not mitigate execution when consumers import th...

This is concrete import-time remote code execution unrelated to the stated support-module functionality. Lack of an npm lifecycle hook does not mitigate execution when consumers import th...

This is concrete import-time staged-payload execution, not package-aligned telemetry. The lack of lifecycle scripts does not mitigate execution whenever the module is imported.

This is a concrete import-time staged-payload execution chain, not telemetry: it retrieves and runs an unverified native binary without user action. The absence of lifecycle hooks does no...

The runtime-imported bootstrap implements an unconsented remote payload execution chain; no lifecycle hook is needed for activation. The benign-looking exported class does not mitigate th...

This is a concrete import-time staged payload and native execution chain, not normal telemetry. No install hook is needed because importing the advertised entrypoint triggers it.

This is an import-time remote binary loader and launcher with no package-aligned purpose or user consent. The concrete download-to-disk-to-detached-execution chain warrants blocking.

Source establishes an immediate, stealthy download-and-execute chain on import. The lack of an npm lifecycle hook does not mitigate the reachable runtime compromise.

This is concrete import-time remote payload execution, not legitimate telemetry: the declared API client has no need to fetch and launch hidden executables. The lack of install hooks does...

This is a concrete import-time staged-payload execution chain, not telemetry behavior. The lack of lifecycle hooks does not mitigate runtime remote code execution on import.

This is a concrete, automatically reachable remote-payload execution chain with stealthy delivery and execution. The absence of npm lifecycle hooks does not mitigate import-time RCE.

The import-time loader has no package-aligned function and directly stages and executes attacker-controlled remote bytes. The benign-looking API and telemetry module do not mitigate that...

Source inspection confirms an import-time staged-payload downloader and executor, not merely telemetry. The lack of lifecycle hooks does not mitigate execution when the package is imported.