MAL-2026-10893 Malicious code in ecto-cargo-wk1tm59a (npm)

Package [email protected] exhibits several contextual red flags worth human review: a randomized-suffix name pattern (-wk1tm59a) typical of disposable/throwaway publishes, an inflated 99.0.0 version typical of dependency-confusion / proof-of-concept publishes, and only 3 files in the tarball. Automated content inspection of the package's code did not produce a usable trace, but the content was non-trivial enough that an automated description could not be produced. No specific attacker domain, exfiltration endpoint, or install-time fetch-and-execute behavior has been concretely identified from the available evidence, so a public block verdict is not justified, but the combination of disposable-name shape, 99.0.0 version inflation, and untraced contents warrants human inspection before this package is trusted.