Vulnerability MAL-2026-18623

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 4.3.3; tarball SHA-256 d3d633c35cdfcf07a34516e2f1d6a1761c15d4e5b0769b0fb55117520cc90225.