discovered 2026-07-01
scripts/postinstall.js md5 in @tqm-mfe/main@5.4.7. ~182 KB obfuscator.io-style single-line payload, RC4/XOR-behind-base64 obfuscation class (same family as @marketfront Wave 4). Differs from the 5.5.0 postinstall.js.
