Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 4
1,194 packages with LPM's own review, newest scan first. Showing 145–192.
The package contains a concrete, obfuscated import-time remote payload execution chain. Lack of npm lifecycle hooks does not mitigate the ESM import path.
The ESM runtime entry contains a concrete concealed payload-execution chain, not merely suspicious primitives. Lack of lifecycle hooks does not mitigate import-time arbitrary execution.
The package deliberately performs an unconsented, silent import-time installation of a differently named registry package in the consumer project. This is a concrete supply-chain executio...