Malicious code in service-roles-registry (npm)

service-roles-registry runs code during npm install that reads the process environment, credential files or the machine's identity and contains a request to an external collection endpoint: - 99.0.2 published 2026-11-02 17:53 UTC: its preinstall script is node index.js, which npm runs during npm...