MAL-2026-18216 — Malicious code in @grabcad/preferences-client (npm)

@grabcad/preferences-client presents itself as a compatibility shim, but its functional effect is a beacon that runs on installation and package import. It sends system and build-environment data over HTTP to a hardcoded external IPv4 address.