Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 24
1,194 packages with LPM's own review, newest scan first. Showing 1,105–1,152.
This is not a benign library artifact: the package auto-executes third-party remote code and installs a browser request-routing proxy to unrelated infrastructure. No install hook is neede...
This is not an install-hook compromise, but it is a deliberately obfuscated static package whose primary entrypoint immediately delegates code execution to an unrelated remote host and co...
Direct source inspection confirms automatic remote-code execution and local obfuscated dynamic execution when the declared HTML entrypoint is opened. Absence of npm lifecycle hooks does n...