MAL-2026-18320 — Malicious code in @walknpm/todo-cli (npm)

OpenSSF Package Analysis identified @walknpm/todo-cli version 2.0.1 as malicious. Its only change from version 2.0.0 is a postinstall script, scripts/miner.sh, that runs during npm install.