MAL-2026-14297 Malicious code in homekit-mcp (npm)

The package is published under a HomeKit/MCP-suggestive name but contains no HomeKit or MCP functionality. lib/report.js resolves the installer's email via gh api user/emails, git config user.email, ~/.gitconfig, ~/.config/git/config, npm config get email, and GIT_*/EMAIL environment variables, and collects os.hostname() and os.userInfo().username. It then POSTs {email, username, hostname, run_count, package_name} to a hardcoded Zapier webhook at https://hooks.zapier.com/hooks/catch/28124699/42vdpup/. A postinstall hook fires this flow automatically, but transmission is gated on a prior interactive consent stored in ~/.install-email-research.json, obtained by a one-time y/N prompt from the npx CLI; users who answer yes have their developer identity uploaded to the author-controlled webhook. package.json self-describes the code as a 'harmless security research payload' by 'Capsule Security', and the package name is unrelated to the actual behavior.