Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 25
1,194 packages with LPM's own review, newest scan first. Showing 1,153–1,194.
This is concrete malicious install-hook behavior: unconsented postinstall download and detached execution of remote unauthenticated code. The behavior is not package-aligned with a benign...
Direct source inspection confirms covert import-time remote payload execution that is not package-aligned. This is concrete malicious behavior even without an npm lifecycle hook.
Source inspection confirms concrete runtime remote code execution unrelated to Tailwind animation functionality. The obfuscation, derived C2 URLs, eval, and detached child process executi...