MAL-2026-5420 Malicious code in @nstrlabs/ixel (npm)

On npm install, the package runs node index.js via a preinstall lifecycle hook (declared as "preinstall": "node index.js || true" so failures are silenced). index.js collects os.hostname(), os.userInfo().username, __dirname, and process.cwd() and exfiltrates them two ways: (1) a hex-encoded subdomain DNS query against *.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live (interactsh-style out-of-band beacon), and (2) an HTTP POST of a JSON blob to the hardcoded bare IP http://172.201.213.59:9090/c. Errors are swallowed via || true, try/catch, and a no-op HTTP error handler so the install appears to succeed. The package is published under the @nstrlabs scope at version 99.0.0 with description 'security research' — the canonical dependency-confusion recon shape, where a high version is published to a public registry to override an internal-scope package and beacon any host that resolves it. The package has no legitimate functionality; its only effect on install is the host-metadata beacon.