Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 12
1,194 packages with LPM's own review, newest scan first. Showing 529–576.
The entrypoint reaches concrete remote payload download and execution code at import time. Lack of an install hook does not mitigate this runtime remote-code-execution behavior.
Concrete import-time remote payload acquisition and execution establishes malicious behavior. The absence of an npm lifecycle hook does not mitigate the reachable import-time loader.
This is concrete import-time remote payload execution, not configuration-loading functionality. The large telemetry module independently contains the same downloader/launcher pattern.