Vulnerability MAL-2026-18367

[email protected] is a dependency-confusion package aimed at Coinbase (its README and postinstall.js say so, and the beacon path is cbhq-canary) with no functional code. Its postinstall script runs node postinstall.js on npm install, which writes a marker file to the temp directory and POSTs the hostname, username, working-directory name, CI flag and Node version to https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary. It was published by the npm account hologrammmm0x, which has no other packages.