Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 22
1,194 packages with LPM's own review, newest scan first. Showing 1,009–1,056.
The decoded, hidden install and immediate execution of an undeclared package are concrete malicious behavior, not polyfill functionality. Absence of a lifecycle hook does not mitigate imp...
This is a concrete remote code-execution loader, not package-aligned icon functionality. Absence of an install hook does not mitigate the runtime execution path.
Source inspection confirms a concealed remote-code-execution path in src/index.cjs. It is not install-time, but it is concrete malicious functionality rather than a package-aligned feature.