Vulnerability MAL-2026-18373

@zmtcdn/ui 9999.0.0 and 9999.0.7 are dependency-confusion packages with an empty index.js and a description of "Security research PoC". Their postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment variables to https://www.hinny.shop/api. They were published by the npm account kill_shs, which also published @zmtcdn/components with the same script.