MAL-2026-16437 Malicious code in eslint-plugin-i18n-shreddit (npm)

[email protected] ships no ESLint plugin code; the tarball's only function is a postinstall hook (scripts.postinstall = 'node index.js') that runs automatically on npm install. index.js collects installer-side reconnaissance — os.userInfo().username, process.cwd(), os.hostname(), and the local IPv4 address — and POSTs the values as JSON to a hardcoded anonymous collector at https://webhook.site/f9bff304-3053-4d54-be05-86537267514a. Package metadata is characteristic of a dependency-confusion probe: version 99.9.9 (chosen to win resolution against a lower-versioned internal package of the same name), empty description, empty author, and no exported plugin functionality. Installing this package leaks the installer's identifiers and network position to an attacker-controlled webhook, identifying vulnerable internal build environments for follow-on targeting.