Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 23
1,194 packages with LPM's own review, newest scan first. Showing 1,057–1,104.
Direct source inspection confirms a remotely controlled arbitrary-code execution path exposed by the package runtime API. The absent lifecycle hook limits install-time behavior but does n...
This is a concrete, concealed remote-code-execution path reached by normal package use, not merely a suspicious primitive. The absence of install hooks limits automatic installation-time...
Direct source inspection confirms a concealed payload appended to the public CLI entrypoint and executed on every CLI invocation. The absence of an install hook does not mitigate this con...