Malicious code in @zmtcdn/components (npm)

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment...

MAL-2026-18372 Malicious code in @zmtcdn/components (npm)

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment...

Malicious code in @zmtcdn/components (npm)

@zmtcdn/[email protected] is a dependency-confusion package with an empty index.js and a description of "Security research PoC". Its postinstall script runs node postinstall.js on npm install, which POSTs the hostname, username, platform, working directory and the names of all environment...