Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 20
1,194 packages with LPM's own review, newest scan first. Showing 913–960.
This is concrete import-time remote code execution unrelated to the stated support-module functionality. Lack of an npm lifecycle hook does not mitigate execution when consumers import th...
This is concrete import-time staged-payload execution, not package-aligned telemetry. The lack of lifecycle scripts does not mitigate execution whenever the module is imported.
This is a concrete import-time staged-payload execution chain, not telemetry: it retrieves and runs an unverified native binary without user action. The absence of lifecycle hooks does no...