Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 8
1,194 packages with LPM's own review, newest scan first. Showing 337–384.
The package's advertised API is inert, but its import-time side module implements an unconsented download-and-execute chain. This is concrete malware behavior, not telemetry.
Direct inspection confirms an import-time downloader/executor unrelated to the declared test-component API. The absence of lifecycle hooks does not mitigate runtime arbitrary-code execution.
The package executes an obfuscated, unverified remote binary loader on import. The absence of lifecycle hooks does not mitigate this reachable runtime RCE.