Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 3
1,194 packages with LPM's own review, newest scan first. Showing 97–144.
The automatic, unpinned global self-update is a concrete remote code execution supply-chain path, not required for commit-message generation. No install hook is present, but runtime activ...
This is a concealed remote code loader, not ordinary image parsing. The absence of an install hook does not mitigate runtime execution of a payload selected by attacker-controlled image d...
Although installation has no automatic registry lifecycle hook, the package combines deliberate obfuscation with remote-controlled shell execution in its normal runtime path. This is a co...