MAL-2026-15924 Malicious code in real-router-telemetry (npm)

Package ships telemetry.js, an obfuscated module (string-array accessor pattern hiding identifiers and the destination) that reads host identity (hostname, username, cwd, platform, arch, memory, cpu info), executes cat /etc/os-release and ps aux, reads .env from the current working directory via fs.readFileSync, and POSTs the collected JSON to https://webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4, an anonymous request-capture endpoint unrelated to any declared publisher. .env files in a developer's cwd typically contain API keys, tokens, and other credentials that do not belong to this package. package.json declares a postinstall hook (node -e "require('./index.js')"); index.js in this build is a stub (declaring version 1.0.1 while the manifest is 1.0.4) that does not currently require telemetry.js, so the shipped payload is staged but not wired into the install-time entry point in this version. The combination of an obfuscated host-and-secret exfil module targeting an anonymous webhook collector, mismatched version metadata, and an install-time hook aimed at the package's own entry point indicates a malicious package.