Malicious code in wxwxtt (npm)

wxwxtt is a dependency-confusion package versions up to 99.0.1 from the same campaign as troubleshooting MAL-2026-17641: a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to the...