MAL-2026-18324 — Malicious code in publish-poc-test3 (npm)

The package's postinstall script creates a temporary directory, writes a fabricated package.json file, and invokes “npm publish” against the public npm registry using the npm authentication context available in the installation environment. This can publish a new randomly named package under the installer's npm identity.