MAL-2026-13943 Malicious code in cilm-ui-commons (npm)

On npm install, the preinstall hook executes index.js which collects host identity data (os.hostname(), os.userInfo().username, os.homedir(), current working directory, DNS server list) together with the full package.json contents and POSTs them to the hardcoded external endpoint https://eogo57c0daum9d3.m.pipedream.net. The behavior fires unconditionally at install time on every installer machine. A code comment references burpcollaborator/Interactsh-style beaconing, consistent with dependency-confusion reconnaissance: the beacon fires when a private internal package name is inadvertently resolved from the public npm registry, revealing the victim's internal infrastructure to whoever controls the pipedream endpoint. The exfiltrated fields identify the installer's host, user account, filesystem layout, network DNS configuration, and internal package/dependency graph.