MAL-2026-17749 — Malicious code in @myorder-frontend-commons/analytics (npm)

OpenSSF Package Analysis identified malicious code in the npm package @myorder-frontend-commons/analytics version 99.0.0. The package contains installation lifecycle scripts that execute poc.js, collect host identifiers, and transmit them to third-party collectors.