Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 17
1,194 packages with LPM's own review, newest scan first. Showing 769–816.
This is a concrete import-time remote-code-execution chain unrelated to the advertised UI input package. The duplicated telemetry implementation contains the same downloader pattern but i...
The package has a concrete import-time remote-code-execution chain unrelated to its declared UI-icon purpose. The elaborate telemetry module duplicates the same payload-loader pattern but...
This is a concrete import-time staged-payload execution chain unrelated to the advertised UI toolkit. It enables an attacker controlling the endpoints or DNS records to execute arbitrary...