Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 14
1,194 packages with LPM's own review, newest scan first. Showing 625–672.
This is a concrete import-time remote payload execution chain unrelated to the advertised React component package. The absence of lifecycle hooks does not mitigate runtime execution on no...
Concrete import-time download-and-execute behavior is present in the published entrypoint. The lack of an install hook does not mitigate runtime compromise on normal package use.
This is concrete import-time remote code execution unrelated to the declared UI-tooltip functionality. No install hook is required for the attack to execute.