MAL-2026-17768 — Malicious code in the cloudflare_module npm package

cloudflare_module@99.0.1 is a dependency-confusion lure targeting the cloudflare_* namespace. Its installation script sends system and working-directory information to a hardcoded IP address, and the same request is also triggered when the package is loaded by a downstream application or bundler.