Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 5
1,194 packages with LPM's own review, newest scan first. Showing 193–240.
The automatic remote executable/wheel chain is paired with deliberate concealment and post-install rewriting, establishing a concrete stealthy staged-payload behavior. Embedded hashes do...
This is a concrete remote-code-execution loader, inconsistent with the documented utility package. Lack of an install hook limits automatic activation but does not remove the malicious ru...
The advertised library code is benign, but its postinstall hook silently stages and executes server-controlled code. This is a concrete malicious supply-chain execution chain.