Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 7
1,194 packages with LPM's own review, newest scan first. Showing 289–336.
Direct source inspection confirms a reachable import-time downloader and executor, not merely telemetry behavior. The lack of install hooks does not mitigate runtime execution on package...
This is an unconsented import-time staged payload chain culminating in arbitrary native code execution. The harmless-looking public API and unused telemetry source do not mitigate that co...
The import-time loader establishes a concrete staged-payload execution chain; the lack of an npm lifecycle hook does not mitigate runtime compromise.