Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 11
1,194 packages with LPM's own review, newest scan first. Showing 481–528.
This is concrete import-time remote code execution, not package-aligned telemetry. The similarly structured telemetry module contains the same payload-loader capability but is not needed...
This is concrete import-time staged remote code execution unrelated to an event emitter; no user action or declared lifecycle hook is required.
This is a concrete import-time remote payload execution chain concealed behind an unrelated HTTP package. The duplicate native-profiler machinery in lib/telemetry.js reinforces the staged...