Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 19
1,194 packages with LPM's own review, newest scan first. Showing 865–912.
The install hook executes a concealed, unrelated payload with remote dynamic evaluation and credential-handling primitives. This is concrete malicious install-time behavior, not package-a...
The preinstall hook deliberately bootstraps and executes an unrelated obfuscated payload, including remote code evaluation and credential-related logic. This is concrete malicious install...
This is a concrete remote code-execution primitive, despite being gated behind an explicitly enabled debug plugin. No install-time behavior was found.