Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 15
1,194 packages with LPM's own review, newest scan first. Showing 673–720.
The import-time, unverified remote payload execution chain is concrete and complete in _loader.js. Absence of lifecycle scripts does not mitigate runtime execution when consumers import t...
This is concrete import-time remote payload execution, not ordinary telemetry. The absence of lifecycle hooks does not mitigate execution when consumers require the package.
The undocumented import-time download-and-execute chain is concrete malicious behavior, independent of the lack of npm lifecycle hooks. Its stated token API does not require telemetry or...