Vulnerability MAL-2026-17879

@flexmr/[email protected] runs node beacon.js preinstall, node beacon.js install, and node beacon.js postinstall during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to 177.7.60.239:48080 and encode the hostname in a DNS query under oob.recon.dev, probing whether a build resolves the package from the public npm registry; it was published on 2026-10-13.