Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 16
1,194 packages with LPM's own review, newest scan first. Showing 721–768.
The package's stated API does not require a native executable, yet import-time code silently downloads and executes one with no meaningful integrity verification. The remote payload sourc...
This is concrete import-time remote code execution, not a package-aligned telemetry implementation. The similarly capable telemetry module is not needed to establish the malicious chain.
This is concrete unconsented remote native payload execution on normal package import, not legitimate telemetry. The lack of lifecycle hooks does not mitigate the reachable import-time ex...