npm security reports, with evidence.

Concrete import-time download-and-execute behavior establishes malware, independent of the scanner label. The lack of lifecycle hooks does not mitigate execution when consumers load the p...

The behavior is reachable during ordinary package import and executes an unauthenticated remote binary without user action. The telemetry naming and opt-out variables do not mitigate the...

The payload chain is reachable from the declared main entrypoint and enables arbitrary remote code execution without user action. Absence of lifecycle scripts does not mitigate import-tim...

The declared entrypoint causes concrete remote-payload execution without a user-invoked setup action. The benign metrics export does not justify this hidden import-time binary launcher.

This is a concrete, import-triggered remote payload download-and-execute chain unrelated to the stated chat-message interface. Absence of npm lifecycle hooks does not mitigate runtime RCE.

This is a concrete, reachable remote payload execution chain, not ordinary telemetry. Lack of an npm lifecycle hook only limits the trigger to package import.

This is a concrete import-time staged-payload and remote-execution chain unrelated to the declared UI toolkit. The absence of lifecycle hooks does not mitigate execution through the norma...

This is a concrete import-time remote-code-execution chain unrelated to the declared config SDK functionality. The lack of npm lifecycle hooks does not mitigate runtime import execution.

The malicious loader is reachable at import time and executes unverified remote bytes. No lifecycle hook is required for the attack to affect package consumers.

This is a concrete import-time remote payload execution chain unrelated to the exported metrics collector. The absent npm lifecycle hook does not mitigate execution on normal package import.

The package has a concrete import-time download-and-execute chain with obfuscated endpoint construction and DNS fallback. This is remote code execution, not package-aligned telemetry.

This is a concrete import-time staged payload loader and remote code execution chain, not ordinary telemetry. The unused telemetry module contains a parallel configurable loader design, r...

This is an import-time staged payload loader with covert fallback transport and detached execution; it is unrelated to the documented abstraction-layer API.

This is a concrete, import-time remote payload execution chain unrelated to the package's stated minimal API. The lack of lifecycle scripts does not mitigate execution when consumers impo...

The package's declared icon/adapter behavior does not justify hidden import-time remote binary execution. The directly inspected loader establishes a concrete staged-malware chain.

This is concrete import-time remote payload execution, not normal telemetry. No installation hook is needed because any consumer runtime import triggers it.

The package's declared EventBus/test-fixture purpose does not justify an import-time remote binary loader. The concrete download-and-execute chain establishes malicious behavior.

Source inspection confirms an import-time downloader and detached payload launcher, not just suspicious primitives. The absence of lifecycle hooks does not mitigate execution on normal im...

This is a concrete import-time staged payload chain with arbitrary binary execution, unrelated to the advertised pub/sub adapter. The absence of npm lifecycle hooks does not mitigate the...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The absence of npm lifecycle hooks does not mitigate activation through the package main entrypoint.

The package contains an import-time, obfuscated remote payload loader that executes unverified downloaded binaries. Lack of lifecycle hooks does not mitigate the reachable runtime attack...

This is concrete import-time remote payload execution with concealed delivery infrastructure and no usable integrity check. It is unrelated to the exposed payments API.

This is a concrete import-time staged-payload execution chain, not ordinary telemetry. The larger telemetry module independently contains the same payload-download-and-launch capability w...

This is concrete import-time remote payload execution, unrelated to the advertised metrics collector. The absence of an install hook does not mitigate execution when consumers import the...

This is a concrete, automatic remote-payload execution chain unrelated to the declared carousel functionality. It is malicious despite having no npm lifecycle script.