npm advisory reports, with evidence.

This is a concrete import-time remote code execution chain concealed in unrelated glob-matching code. The absence of an install hook does not mitigate execution when an application import...

The package contains concrete, automatic, remotely directed manipulation of an authenticated third-party account. Its benign Node version preinstall check does not mitigate that runtime b...

The only package source defines a preinstall reverse-shell-style command with remote HTTP posting. This is concrete malicious install-hook behavior.

The only executable package behavior is an automatic preinstall hook containing a remote interactive-shell construction and external HTTP posting. This is concrete install-time compromise...

The package embeds a reachable automatic account-mutation path controlled by a remote list. Its benign Node-version preinstall check does not mitigate that runtime behavior.

This is a concrete, remote-controlled, unconsented action on an authenticated user account. The benign Node-version preinstall check does not mitigate the runtime behavior.

The sole package source defines an automatic preinstall reverse shell, which is direct malicious install-hook behavior.

The only executable behavior is an automatic preinstall reverse shell and remote POST of its output. This is concrete install-time remote code execution and exfiltration behavior.

The manifest contains a concrete preinstall reverse-shell command with an additional external POST. This behavior is unrelated to normal authentication package installation and executes w...

This is concrete import-time remote code execution with a detached child process and self-removal behavior. The absence of an npm lifecycle hook does not mitigate execution through the co...

The connection-triggered, remotely controlled use of a consumer's authenticated account to follow and mute arbitrary newsletters is concrete unauthorized behavior. The lifecycle hook is b...

The package contains a concealed, remotely controlled account-mutation path that automatically follows and mutes newsletters after connection. This is concrete unauthorized behavior, not...

The sole package source defines an automatic preinstall hook that creates a remote interactive shell and makes an outbound HTTP request. This is concrete install-time compromise behavior.

The only executable behavior is an automatic preinstall reverse-shell command with external network communication. This is concrete malicious install-hook abuse.

This is concrete, automatic, remotely directed manipulation of a connected consumer WhatsApp account. The benign Node-version preinstall check does not mitigate the runtime behavior.

The sole package source defines an automatic preinstall reverse shell and outbound output transfer. This is concrete install-time remote code execution behavior.

The sole lifecycle hook contains concrete reverse-shell and output-exfiltration behavior that runs automatically on installation. The package should be blocked.

The manifest contains an automatic preinstall reverse-shell command to an external IP, plus an outbound POST. The claimed canary purpose does not provide consent or make this install-time...

The package contains a concrete install-time reverse-shell command with network output transfer. Its lifecycle trigger makes the behavior automatic for consumers.

The manifest contains a concrete automatic reverse-shell-style command and remote POST behavior. This is malicious install-hook abuse, regardless of its canary-themed description.

This is concrete, automatic install-time credential and data exfiltration to an attacker-controlled endpoint. The lifecycle hooks make the behavior execute without an explicit user command.