Remote code execution in npm packages.
These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.
Packages — page 9
1,194 packages with LPM's own review, newest scan first. Showing 385–432.
The behavior is import-time, concealed, and executes attacker-controlled remote bytes without user action. Lack of npm lifecycle hooks does not mitigate the reachable loader.
This is a concrete, automatically triggered remote payload execution chain unrelated to the package's stated minimal library API. Opt-out environment checks do not establish informed user...
This is a concrete, import-triggered remote payload execution chain unrelated to the package’s stated interface. The same staged native-profiler pattern also appears in lib/telemetry.js.