MAL-2026-17705 — Malicious code in css-overscroll-contain (npm)

The package css-overscroll-contain contains code that performs host reconnaissance and bulk credential theft when its modules are loaded. The source states that any computer with the package installed or running should be considered fully compromised.