Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 2
1,194 packages with LPM's own review, newest scan first. Showing 49–96.
This is a concrete, reachable arbitrary binary execution chain, not merely ordinary tunnel networking. The absence of an npm install hook does not mitigate the runtime remote-code-executi...
The unverified remote-script execution is a concrete remote-code-execution path, and the daemon also sends identified logs to a default external endpoint. Absence of an npm lifecycle hook...
index.js is a reverse-shell dropper on the published main export, with check.js and CI invoking it. That is concrete remote code execution, not dual-use tooling.