Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages
1,194 packages with LPM's own review, newest scan first. Showing 1–48.
The package has no install hook, but its executable performs automatic remote code updates in Git checkouts and restarts into the changed code. This is a concrete remote code execution pa...
The default-on runtime path executes unverified remote code inside CAD, establishing a concrete remote code execution surface. This supports blocking publication regardless of the package...
The daemon provides a reachable chat command that executes sender-supplied shell text, while the inspected Telegram path does not restrict execution to authorized senders. This is a concr...
