MAL-2026-4822 Malicious code in loadtest-browser-lib (npm)

On npm install, the package's preinstall hook executes index.js, which collects host identifiers (hostname, username, platform, arch, cwd, pid, timestamp) and sends them as query parameters in an HTTPS request to fxpkkxatijbbyxuhdclqig6334q9m1j8w.oast.fun, an out-of-band callback host. package.json declares "preinstall": "node index.js", so the beacon fires automatically on default install with no user interaction. The package self-describes as 'hijacking by yusif', consistent with a dependency-confusion / namespace-hijack proof-of-concept payload. Any installer running npm install leaks identifying machine information to the attacker's collaborator endpoint.