discovered 2026-07-01
postinstall.js payload SHA256 in @emcd-vue/auth@7.1.0 (Wave 3 scope, republished/live as of 2026-07-02). Corroborates the same-operator link across waves.
