Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 18
1,194 packages with LPM's own review, newest scan first. Showing 817–864.
Source directly establishes import-time download-and-execute behavior with attacker-controlled remote payload bytes. The lack of lifecycle scripts does not mitigate the reachable import-t...
This is concrete import-time remote code execution concealed behind an unrelated wrapper API. The absence of lifecycle scripts does not mitigate execution when consumers import the package.
The concealed import-time download-and-execute chain is concrete remote code execution and unrelated to the tiny advertised library API. Absence of an npm lifecycle hook does not mitigate...