Vulnerability MAL-2026-18453

[email protected] has no install script of its own but depends on exactly [email protected], so npm install runs that package's preinstall script (node preinstall.js). The script POSTs the machine's hostname and the OS username to the Discord webhook https://discord.com/api/webhooks/1566215853794394162/xsqpEbSn-cc3DU2AKWdzqWnXX5hjTfV-gUePQZ4evrHGlZctMd40TKCrN42qnJd7moc1. Both packages were published by the npm account bigdevin55 on 2026-11-01.