discovered 2026-07-01
scripts/postinstall.js md5 in @tqm-mfe/main@5.5.0 (dist-tag latest, changelog claims 'Added ARM64 support'). Differs from the 5.4.7 postinstall.js md5, indicating a re-obfuscated / updated payload between the two ~2h-apart versions.
