MAL-2026-17766 — Malicious code in the npm package @s4yhiitestpoc/scan-https-d

This is a dependency-confusion proof-of-concept package. A postinstall script runs during installation, collects installer host and user identifiers, and sends them to a hardcoded third-party domain without the installer’s explicit opt-in. The source states that any computer on which the package was installed should be considered fully compromised.