discovered 2026-09-23
npm loader module (launchStageZero / collectStageZero) in the malicious plugin versions.