MSC-2026-12683

The npm package @ziedzzz/demo-canary version 1.0.0 contains a malicious install hook. package.json declares a postinstall script that runs index.js, which builds a host fingerprint containing the hostname, username, home directory, operating system, CPU and memory details, internal IP and MAC...