MAL-2026-18319 — Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is described as a dependency-confusion package and a “Compatibility shim.” Its versions contain a postinstall script that runs beacon.cjs during npm installation; the same code is also run when the package is imported. The beacon sends the hostname, install path, current working directory, Node.js version, and package name in cleartext HTTP POST requests to http://185.158.107.175:8787/_ah/dc.