MAL-2026-16315 Malicious code in test1ro (npm)

package.json declares preinstall and postinstall hooks that run node index.js, which reads os.hostname() and issues an HTTP GET to the hardcoded third-party collector http://eo8f3m3ho26a0nm.m.pipedream.net/<package>?h=<hostname>. The behavior fires automatically during npm install without any user action, transmitting the installer's host identifier and the resolved package name to an external Pipedream request-bin. The manifest also declares test1ro: ^999.99.99 as its own dependency at an implausibly high version, characteristic of a dependency-confusion artifact designed to be resolved from public npm ahead of an internal package of the same name. The generic name, self-referential high-version pin, and install-time beacon to an attacker-controlled collector match the standard dependency-confusion probe shape.