Vulnerability MAL-2026-18372

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to https://webhook.site/f52af355-4783-4acb-9de1-5e44b5963025. It was published by the npm account kill_shs, which also published @zmtcdn/ui with the same script.