Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 21
1,194 packages with LPM's own review, newest scan first. Showing 961–1,008.
The package contains an import-time, obfuscated remote payload loader that executes unverified downloaded binaries. Lack of lifecycle hooks does not mitigate the reachable runtime attack...
This is concrete import-time remote payload execution, unrelated to the advertised metrics collector. The absence of an install hook does not mitigate execution when consumers import the...
This is a concrete, automatic remote-payload execution chain unrelated to the declared carousel functionality. It is malicious despite having no npm lifecycle script.