Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 6
1,194 packages with LPM's own review, newest scan first. Showing 241–288.
This is a concrete import-time remote payload execution chain, unrelated to the stated data-transformation purpose. The absence of lifecycle scripts does not mitigate execution on normal...
This is a concrete, automatically triggered remote payload execution chain unrelated to the declared UI-helper package purpose. No install hook is needed because the malicious behavior ex...
The import-time downloader and detached execution chain is concrete and does not require a lifecycle hook. The telemetry naming and opt-out variables do not mitigate arbitrary remote bina...