Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 13
1,194 packages with LPM's own review, newest scan first. Showing 577–624.
The import-time loader implements an unconsented remote native-payload execution chain. No install hook is required because ordinary package import triggers it.
Source inspection confirms an import-time, silent remote payload execution chain unrelated to the package's stated shared-primitives purpose. The absence of npm lifecycle hooks does not m...
The package’s normal import path performs stealthy remote payload retrieval and execution, with no user action or documented need. Obfuscated endpoint construction, DNS fallback, temporar...