Vulnerability MAL-2026-18454

[email protected] presents itself as a test fixture for npm lifecycle hooks. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname and the OS username to the Discord webhook https://discord.com/api/webhooks/1566215853794394162/xsqpEbSn-cc3DU2AKWdzqWnXX5hjTfV-gUePQZ4evrHGlZctMd40TKCrN42qnJd7moc1. It was published by the npm account bigdevin55 together with [email protected], which pulls it in as a dependency.