MAL-2026-10493 Malicious code in insomnia-plugin-poc-m4gester-run (npm)

package.json declares a postinstall lifecycle hook that runs calc.exe on the installer's machine during npm install. The main entry point exports only an empty requestHooks array, providing no actual Insomnia plugin functionality — the package's sole effect is the arbitrary command execution at install time. The name self-identifies as a proof-of-concept and mimics the Insomnia plugin naming convention with a leet-substituted variant, indicating the package exists solely to demonstrate/exploit install-time RCE. While calc.exe itself is benign, the postinstall hook establishes full arbitrary-command-execution capability against any developer installing the package on Windows.